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Abstract 

This paper presents stronger methods of achieving perfect completeness in quantum interactive proofs. First, 
it is proved that any problem in QMA has a two-message quantum interactive proof system of perfect complete- 
ness with constant soundness error, where the verifier has only to send a constant number of halves of EPR 
pairs. This in particular implies that the class QMA is necessarily included by the class QIP]^(2) of problems 
having two-message quantum interactive proofs of perfect completeness, which gives the first nontrivial upper 
bound for QMA in terms of quantum interactive proofs. It is also proved that any problem having an m-message 
quantum interactive proof system necessarily has an (m + l)-message quantum interactive proof system of per- 
fect completeness. This improves the previous result due to Kitaev and Watrous, where the resulting system of 
perfect completeness requires m + 2 messages if not using the parallelization result. 



1 Introduction 



1.1 Background and Motivation 

The classical complexity class MA of problems having Merlin-Arthur (MA) proof systems, first introduced by 
Babai HBabSSl . is a natural probabilistic generalization of the class NP. Informally, in a Merlin-Arthur proof 
system, Arthur, a probabilistic polynomial-time verifier, first receives a message (a witness) from Merlin, an all- 
powerful but untrustworthy prover, and then checks with high probability the vaUdity of Merlin's claim that the 
common input is a yes-instance of the problem. 

Quantum Merlin-Arthur (QMA) proof systems are a generalization of the Merlin-Arthur proof systems to 
the quantum setting, whose notion was already discussed at an early stage of quantum computing research in a 
technical report by Knill ||Kni96 1. In this setting, Arthur now receives a quantum witness from Merlin and performs 
polynomial-time quantum computation to check with high probability whether the input is a yes-instance or not. 
The resulting complexity class is called QMA [WatOO] (originally called BQNP [Kit99l IKSV02II ). and has been 
central to the development of quantum complexity theory in that it plays a role similar to that NP plays in classical 
computation. 

The standard way of defining MA and QMA allows two-sided bounded error: each yes-instance may be 
wrongly rejected with small probability (completeness error), while each no-instance may also be wrongly ac- 
cepted with small probability (soundness error). If completeness error is zero, that is, any yes-instance is never 
wrongly rejected, the corresponding system is said to have perfect completeness. The versions of MA and QMA 
with perfect completeness are denoted by MAi and QMA^, respectively. 

Classically, it is known that any Merlin-Arthur proof system that may have two-sided bounded error can al- 
ways be modified into another Merlin-Arthur proof system with one-sided bounded error of perfect completeness, 
i.e., MA = MAi holds IIZF871 IGZlll . This is a very nice property in that honest Merlin can always convince 
Arthur without error by providing a suitable witness for a yes-instance. A natural question to ask is whether the 
same property holds for quantum Merlin-Arthur proof systems as well, i.e., whether QMA = QMA^ or not. This 
question still remains unsolved after many years of investigations. Besides its theoretical interest, answering this 
question by the affirmative would lead to many consequences. In particular, any computational problem complete 
for the class QMA^, for instance the Quantum Satisfiability (QSAT) problems |Bra06|, would immediately 
become complete for the class QMA as well. This would not only lead to a better understanding of QMA but 
also have potentials to significantly simplify and strengthen a possible quantum version of the celebrated PCP the- 
orem IIAS981 IaLM +98 I that many researchers have been trying to estabhsh IIAALV091 [AALVl 11 lAEl 11 . partly 
because one-sided error verifications are much easier to treat, and also because the QSAT problems are more direct 
quantum analogues of the SAT problems than the LOCAL HAMILTONIAN problems (note that the classical PCP 
theorem can be viewed as proving the NP-completeness of a special case of the 3 SAT problem in which, for every 
no-instance, at most a constant fraction of clauses are simultaneously satisfiable). 

As a barrier to affirmatively answering the QMA versus QMA^ question, Aaronson IIAar09ll constructed a 
quantum oracle relative to which QMA^ is a proper subclass of QMA, which means that a "black-box" proof of 
QMA = QMA^ cannot exist. Nevertheless, no classical oracle is known that separates QMA^ from QMA. It 
then might not be surprising that the following recent results in some sense step towards an affirmative answer to 
the question: Nagaj, Wocjan, and Zhang [NWZ09| showed that perfect completeness is achievable for a special 
case of quantum Merlin-Arthur proof systems in which some real number related to the maximum acceptance 
probability of a given system can be exactly expressed with a bit string of polynomial length. More recently, 
Jordan, Kobayashi, Nagaj, and Nishimura IIJKNN12 1 proved that the equality holds for quantum Merlin-Arthur 
proof systems of classical witness, that is, QCMA = QCMA^ (or MQA = MQA^ in a recently -proposed termi- 
nology IIWat09al IGSUl II ) holds, assuming that the circuit of a verifier is exactly implementable with a gate set in 
which the Hadamard and any classical reversible transformations are performable without error. In particular, the 
latter result gives evidence that, if we put some natural assumption on a gate set, the quantum oracle barrier by 
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Aaronson ||Aar09ll may not be an insurmountable obstacle when seeking the possibility of QMA = QMA^, as the 
arguments in Ref. ||Aar09ll also lead to a quantum oracle that separates QCMA^^ from QCMA. 

Quantum Merlin-Arthur proof systems may be viewed as a special case of more general quantum interac- 
tive proof systems, where the verifier and the prover may exchange messages using many rounds of commu- 
nications. In their seminal paper, Kitaev and Watrous HKWOOl showed that perfect completeness is achiev- 
able in quantum interactive proof systems. More precisely, with two additional messages, any quantum inter- 
active proof system that may involve two-sided bounded error can be transformed into another quantum inter- 
active proof system that has one-sided bounded error of perfect completeness. This in particular implies that 
QMA C QIP]^(3), where QIP]^(3) is the class of problems having three-message quantum interactive proof sys- 
tems of perfect completeness. Unfortunately, QIP]^(3) is already so powerful that it includes PSPACE IIWat03l (ac- 
tually, QIPi(3) = QIP = PSPACE [K WOOlUJWTTl . where QIP denotes the class of problems having general 
quantum interactive proofs). Accordingly, this only gives a weaker result for the upper bound of QMA, as QMA 
is known to be inside PP KWOOl IWatOOl IMW05I1 (in fact, a slightly stronger bound QMA C AqPP = SBQP is 
known |Vya03[[Kup09l). 



1.2 Our Results and Their Meaning 

This paper presents new general techniques to transform quantum interactive proof systems into those of perfect 
completeness, which increase the number of messages by just one. Our first result states that any problem in QMA 
has a two-message quantum interactive proof of perfect completeness. 

Theorem 1. QMA C QIPi(2). 

Here QIPi (2) is the class of problems having two-message quantum interactive proof systems of perfect com- 
pleteness (with negligible soundness error). This gives the first nontrivial upper bound of QMA in terms of quantum 
interactive proofs, which seems to be incomparable to the known upper bound AqPP = SBQP. Note that the in- 
clusion QMA C QIP(2) is indeed trivial for the two-sided error class QIP(2) of two-message quantum interactive 
proofs, but the inclusion here is by the one-sided error class QIP^(2) and is nontrivial to prove. 

In fact, we prove a much stronger result, which arguably steps towards settling the QMA versus QMA^^ ques- 
tion. Namely, we show that, to achieve perfect completeness with constant soundness error, the verifier in the 
two-message quantum interactive proof system has only to send a constant number of halves of EPR pairs to the 
prover. Or in other words, any problem in QMA has a quantum Merlin-Arthur proof system of perfect complete- 
ness with constant soundness error, in which Arthur and Merlin share a constant number of EPR pairs a priori. 
More formally, let QMA''"^^^(c, s) denote the class of problems having quantum Merlin- Arthur proof systems 
with completeness c and soundness s, where Arthur and Merlin initially share k EPR pairs. Then we have the 
following containment. 

Theorem 2. For any constant s € (0, 1], there exists a constant A; G N such that 

QMA C QMA'=-^p^(1,s). 



Theorem[T]is an immediate consequence of Theorem|2l as one may view quantum Merlin- Arthur proof systems 
with shared EPR pairs as a special case of two-message quantum interactive proofs where the verifier first generates 
the EPR pairs and sends halves of them to the prover (and the parallel repetition of two-message quantum interactive 
proofs works perfectly IIKWOO l). Theorem |2] nevertheless appears to be much stronger than Theorem [T] since 
it shows that perfect completeness is achievable with just one additional message of a very restricted form (a 
constant number of halves of EPR pairs). To see this, let QMA*^""*^*"^^^ be the class of problems having quantum 
Merlin- Arthur proof systems with a constant number of prior shared EPR pairs that may involve two-sided bounded 
error, and let QMA'j;"'^"'"^^^ be that of perfect completeness. Then, indeed, the equality QMA'^""''*"^^^ = QMA 
immediately follows from the result by Beigi, Shor, and Watrous IBSWll I. as any quantum Merlin- Arthur proof 
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system with a constant number of prior shared EPR pairs is a special case of two-message quantum interactive 
proofs with short questions (i.e., two-message quantum interactive proofs with the first message consisting of at 
most logarithmically many qubits). Therefore, we obtain the following characterization of QMA. 

Theorem 3. QMA^""'^*-^^^ = QMA™'^'^*-'^^^ = QMA. 

This in particular implies that perfect completeness is achievable for the model of quantum Merlin-Arthur 
proof systems with a constant number of prior shared EPR pairs, a model that has computational power equivalent 
to QMA. 

The methodology developed in this paper essentially shows that, in order to obtain the inclu- 
sion QMA C QMA^ (and thus immediately the equality QMA = QMA^), it is sufficient to find a way of elimi- 
nating the need for the constant number of shared EPR pairs in our proof system. In fact, as will be clear with our 
proof structure, the constant number of shared EPR pairs are necessary only for the purpose of forcing a dishonest 
prover to send a witness that is close to some maximally entangled state of constant dimensions. Hence, some 
suitable procedure that tests if a given state of constant dimensions is sufficiently entangled or not may replace the 
shared EPR pairs to affirmatively answer the QMA versus QMA]^ question (if two-sided error is allowed, such a 
test is possible with quantum state tomography). Moreover, our construction gives another example of quantumly 
non-relativizing techniques for quantum interactive proofs, which again indicates that Aaronson's quantum oracle 
separation HAarOQII may not be an insurmountable barrier when proving that QMA = QMA^^ or its related results. 

For general quantum interactive proof systems, we further present a method that makes any quantum interactive 
proof system perfectly complete by increasing the number of messages by just one. This improves the previous 
result due to Kitaev and Watrous HKWOOl . whose construction increases the number of messages by two, if not 
using their parallelization result. More precisely, for the class QlP(m) of problems having m-message quantum 
interactive proofs that may involve two-sided bounded error, and the class QIP]^(m) of problems having those of 
perfect completeness, we show the following. 

Theorem 4 (informal statement). For any m> 2, QlP(m) C QIP^(m + 1). 

In fact, if the number of messages in the original system is odd, our transformation does not increase it at all. 

Theorem 5 (informal statement). For any odd m > 3, QlP(m) C QIP]^(m). 

While the inclusions of Theorems |4] and |5] can also be obtained by using the parallelization results in 
Refs. HKWOOl IKKMV091 . our techniques give a new and arguably more direct way of obtaining these results. 
Our construction actually works well even in the setting of quantum multi-prover interactive proof systems: it 
transforms any quantum A; -prover interactive proof system into another quantum fc-prover interactive proof system 
of perfect completeness by increasing the number of turns by just one in general, and without increasing it when 
the number of turns in the original system is odd. This much improves the previous result in Ref. [K KMV09II . 
where the construction increases the number m of turns to 3m (i.e., by a factor of three), again without using their 
paralleUzation result. We refer to Theorems |25] [261 |33l and[34]in Section|7]for the precise statements of the results. 

1.3 Organization of This Paper 

Section |2] gives a high-level explanation of how Theorem |2](i.e, the inclusion QMA C QMA™"^*^*"^^^) is proved. 
Section |3]presents an overview of the proof of Theorem|4](i.e., the inclusion QlP(m) C QIP^(m + 1)). Section]?] 
provides basic notions and definitions that are used in this paper. Section ]5] rigorously describes and analyzes the 
basic procedure called REFLECTION PROCEDURE, which is the fundamental technical tool throughout this paper. 
Section ]6] then gives a full proof of Theorem]2] Finally, Section ]2]proves the results on general quantum interactive 
proofs. 
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Reflection Procedure 

1. Receive a quantum register M. Prepare |0) in each of the qubits in a quantum register A. Apply Vx to the 
state in (A, M). 

2. Perform a phase-flip (i.e., multiply —1 in phase) if the state in (A, M) belongs to the subspace corresponding 
to the projection Ilacc- 

3. Apply to (A, M). 

4. Reject if the state in (A, M) belongs to the subspace corresponding to Ilinit, and accept otherwise. 



Figure 1: The REFLECTION PROCEDURE (speciahzed to the case of QMA proof systems; see Figure[3]in Section[5] 
for the most general version of this procedure). 

2 Overview of the Proof of Theorem |2] 

The purpose of this section is to give a high-level description of our construction that proves the inclu- 
sion QMA C QMA'j:°°''*-^P^. We first describe the main idea in Subsection 12.11 and a simple protocol for a very 
special case. Then we explain in Subsection 12.21 how to make this simple protocol robust against any cheating 
strategy, by introducing additional tests. Finally, in Subsection 12. 3 [ we present our complete protocol. 

2.1 Underlying Ideas 

For an input x, let Vx denote the verifier's quantum circuit in the original QMA proof system. The operator Vx acts 
on two quantum registers, one register A corresponding to the verifier's work space and another register M corre- 
sponding to the space that stores the witness from the proven Let px denote the maximum acceptance probability, 
over all possible witnesses, of the verification procedure. From the definition of the class QMA we can assume 
that, for every yes-instance x we have px > 1/2, and for every no-instance x we have < 1/3. As pointed out 
by Marriott and Watrous IIMW05I . the maximum acceptance probability px of Vx over all possible witnesses is the 
maximum eigenvalue of the Hermitian operator 

Mx = HinitFinaccK^ninit, 

where Ilinit is the projection onto the subspace spanned by states in which all the qubits in A are in state |0), and 
Ilacc is the projection onto the space spanned by the accepting states. 

Reflection Procedure The basic idea of our protocol is to simulate a procedure that we call REFLECTION PRO- 
CEDURE, presented in details in Section |5] Roughly speaking, this procedure is viewed as performing a part of 
amplitude amplification [Gro96| on the original verification procedure, and is quite similar to the so-called quan- 
tum rewinding technique IIWat09bll . the underlying idea of which dates back to the strong amplification method for 
QMA due to Marriott and Watrous IIMW05II . Not surprisingly, our REFLECTION PROCEDURE can be analyzed in 
a way similar to the case of the strong amplification method for QMA due to Maniott and Watrous [MW05|. We 
refer to Figure [T]for a presentation of this procedure specialized to the case of QMA proof systems (a more general 
description of the procedure will be given in Figure |3] in Section [5]). 

Reflection Procedure has access to the unitary transformation Vx, receives a quantum state in register M, 
and has the following property: 
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1. If has an eigenvalue 1/2, then there exists a quantum state in M such that REFLECTION PROCEDURE 
accepts with certainty. 

2. If Mj; has no eigenvalue in the interval — e, ^ + e), then for any quantum state in M given, REFLECTION 
Procedure rejects with probabihty at least 4£^. 

This procedure would then enable us to transform the original QMA proof system into another QMA proof system 
with perfect completeness if we had exactly = 1/2 for any yes-instance x. This nice property on the complete- 
ness of course does not necessarily hold in general. 

We mention that REFLECTION PROCEDURE is actually slightly superior to the original quantum rewinding 
technique (for the purpose of achieving perfect completeness) in that it requires just two applications of Vx (more 
precisely, one application of and one application of Vx), instead of three. This property will be crucial for our 
analysis since REFLECTION PROCEDURE will ultimately be applied to a modified version of Vx that cannot be 
implemented directly by the verifier without the help of the prover. 



Simple Protocol when px is Known In general, we only know that px > 1/2 for a yes-instance. Assume that 
the verifier can apply the matrix 



-VI - Qy 

acting on one qubit, where q is such that < q < 1 and Pxq = 1/2 (the value of q depends of course on the 
input x). Then, by performing in parallel the original verification test (which succeeds with probabihty Px) and an 
additional test that applies Wq on a single qubit in the initial state |0) and measures it, we obtain a new verification 
procedure that accepts the input with probability exactly Pxq = 1/2 (where the new condition for acceptance is that 
the original test accepts and the additional single qubit contains 1). In particular, such a unitary transformation Wq 
always exists for any yes-instance x, and thus, this could achieve the perfect completeness if the verifier knew the 
probability > 1/2. 

The Hermitian operator corresponding to the case of applying in parallel these two tests can be represented by 

M'x = (Hinit \o){o\)iVx ® WgYiu^^ \i)m){Vx ® tn)(ninit ® |o)(o|), 

which has 1/2 as an eigenvalue for a yes-instance x. Moreover, it can be easily shown that, on a negative instance, 
the eigenvalues of this Hermitian operator are bounded away from 1/2. Thus REFLECTION PROCEDURE applied to 
the new verification test Vx ^ Wq transforms the original system into a perfect completeness system. This protocol 
of course works only when the verifier can apply Wq. 



Reflection Simulation Test and Distillation Procedure The main problem with the protocol described above is 

that the verifier does not know in general the probability px, and is then not able to apply Wq. Informally, our basic 
idea to overcome this difficulty consists in asking the prover to send, along with the witness \w) of the original 
proof system, the unitary transformation Wq to the verifier, where pxq = 1/2. Concretely, this is done by asking 
the prover to send two copies of the Choi-Jamiotkowski state associated with Wq, denoted by | J(Wg)) and defined 
as follows: 

\J{Wq)) = (/ Wq)\^+) = y^T^l^-) + V9l*+), 

where |$+) = ^(|00) + |11)), |$") = ^(|00) - |11)) and |*+) = ^(|01) + |10)). By an analysis similar to 
the case of quantum teleportation, one can see that the state \J(Wq)) can be used to simulate one application of the 
unitary transformation Wq to any quantum state of a single qubit in a probabilistic manner; the application succeeds 
with probabihty 1/4, and we know whether it succeeds or not. 
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Let us denote by M the register that is expected to contain the witness \w), and by Si,S'^,S2,S2 the four 
single-qubit registers that altogether are expected to contain the two copies of the Choi-Jamiotkowski states. On a 
yes-instance an (honest) prover will then send the state 

Hm \J{W,))^SuS[) ^ I W)){S2,S^)- 

With this state given, the verifier can simulate the desired QMA system with underlying verification proce- 
dure Vx ^ Wq with success probability (1/4)^ = f/f6 (notice that Wq = Wq, and thus, one copy of \ J{Wq)) 
is used to simulate the application of Wq, and another copy of it is used to simulate the application of Wq). In case 
where the simulation fails, the verifier systematically accepts by giving up the simulation to keep perfect complete- 
ness. This is the core idea of the procedure REFLECTION SIMULATION TEST described in Subsection l6.1.4[ which 
is a key building block in our proof of Theorem |2l 

In fact, we incorporate one more technique called DISTILLATION PROCEDURE, which is again based on the 
analysis of Ref. [ MW 05|. and makes the analysis of our complete protocol significantly easier. In general, one of 
the main difficulties when analyzing the soundness with the simulation of the REFLECTION PROCEDURE with the 
associated Hermitian operator M(. above is that one has to care about the entanglement between the witness part 
in M and the part for the Choi-Jamiolkowski states in Si, S'^, S2, and $2. This could make the soundness analysis 
extremely hard, and in fact, the authors do not even know if the soundness can be proved without using the DIS- 
TILLATION Procedure. The idea to settle this difficulty is that, instead of directly simulating the Reflection 
Procedure above on a received state (that is expected to be a product state of a witness \ w) and two copies of the 
Choi-Jamiolkowski states), one first performs the DISTILLATION PROCEDURE twice in sequence on the witness 
part (i.e., M) of the received state to produce a situation where one can perform a much simplified version of the 
Reflection Procedure that does not even need to receive a witness. This new Reflection Procedure has 
a very nice property that it does not significantly change the behavior of the original REFLECTION PROCEDURE, 
and its associated Hermitian operator acts over a space of just four dimensions and has a much simpler form: 

(|0)(0| ^ \0){0\){Wp Wq)H\l){l\ » \l)mWp Wq){\0){0\ ® |0)(0|), 

where p = p^/ C^Px ~ '^Px + 1) and q = l/{2p) (which is different from the value of q in the previous case with 
M!j.). More precisely, the two apphcations of the DISTILLATION PROCEDURE (described in Subsection 16.1.11 ) 
enables us to generate with high probability two identical copies of the single-qubit state 

ixp) = x/r^io) + vp|i) 

from a given witness \ w) (and one can know whether the generation of the two copies succeeded or not). The point 
is that, if the input were a no-instance, and the original soundness were very small, the generated state should be 
very close to |0) (8) |0), and could be analyzed as if it were unentangled with other qubits. Note that one can easily 
transform \xp) into \ J{Wp)), and thus one essentially obtains the desired two copies of the Choi-Jamiolkowski 
states after the two apphcations of the Distillation Procedure. 

2.2 Towards the Actual Protocol 

The main problem of the strategy described in the previous subsection is of course that, on a no-instance, a 
dishonest prover may not send the prescribed state. Actually, for a dishonest prover who sends a state of the 
form \w) I then no matter which state \w) and no matter which value q the prover chooses, the sound- 

ness can be analyzed with a quite straightforward argument. The real issue lies in the case where a dishonest prover 
does not send a quantum state of the form \w) | J(VFg))®^, and especially when the state in (Si, S'^, S2, S2) is not 
a product state of two identical copies of a Choi-Jamiolkowski state. 

To force a state in (Si, S'^, S2, S2) to be at least close to a mixture of two-fold products of an identical quantum 
state (which may be a mixed state), we modify the protocol so that we can use the finite quantum de Finetti 
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theorem IIKR05 [ ICKMR07II . For this, the verifier now asks the prover to send not only two copies of \ J{Wq)) but 
a larger number of copies of it: \J{Wq))^^ where N is large but still a constant. The expected witness sent by an 
honest prover is then 

\w)m ® I W))(s,,si) ® \J{Wg))(^s,,S',) ® • • • ® I W)>(S^.,S^)• 

The witness state in (M, Si, S'^, . . . ,SAr,S'^) sent by a prover in a general case may of course not be of the 
form above, if the prover is dishonest. After the two applications of the DISTILLATION PROCEDURE with 
M, the verifier permutes the N pairs of registers (Si, S'^), . . . , (Sat, S'^) uniformly at random. This makes 
the state in (Si, S'^), . . . , (Sat, S'^) symmetric (i.e., invariant under any permutation of the N pairs of reg- 
isters (Si, S'^), . . . , (Sat, S'^)), and thus the quantum de Finetti theorem guarantees that the reduced state in 
(Si, S'^, S2, S2) of the resulting state after random permutation must be close to some mixture of two-fold product 
states 

j 

Note that each state may not necessarily be a pure state, and is usually a mixed state. The Swap-Test, performed 
additionally to this random permutation, will ensure that every must be actually close to some pure state. This 
is nevertheless not enough: we want to ensure that each is close to some Choi-Jamiolkowski state. To have this 
desirable property, we now assume that each pair of registers {Sj, S'j) initially contains an EPR pair, and that the 
verifier initially holds the registers Si, . . . , Sat and receives only, additionally to M, the registers S'^, . . . , S'^ as 
witness. This assumption is the only part where we need (a constant number of) shared EPR pairs, and removing 
it is the last obstacle that prevents us from proving the result QMA = QMA^. We then show that this assumption 
of the shared EPR pairs, combined with some suitable measurements, will finally force each to be close to some 
desirable Choi-Jamiolkowski state. 

2.3 Final Protocol 

The final protocol of the verifier in a QMA system of perfect completeness with a constant number of shared EPR 
pairs is given in Figure |2l Actually, Figure |2] presents a slightly simplified exposition of our final protocol; the 
complete description will appear in Section [6] (see Figure [6] in the proof of Theorem O. 

Let us briefly describe the protocol step by step, focusing on what happens when the prover is honest. At the 
end of Step 1, i.e., just after receiving a witness from the prover, the state in (M, Si, S'^, . . . , Sat, S'^y) is given by 

\w)m I J(^n))(Si,Si) ® \J{W,))(^s,,S',) ® • • • ® \J{Wg))(s^,s'^y 

When none of the two executions of the DISTILLATION PROCEDURE fails in Step 2, the state in 
(Ri, R2, Si, S'l, . . . , Sat, S'^) becomes 

IXp)ri ® \Xp)r2 ® I W))(Si,Si) ® I W))(S2,S^) ® • • • ® \JiWg))is^,s'^), 

at the end of this step. Step 3 just permutes the N pairs of registers (Si, S'^^), . . . , (Sat, S'^) uniformly at random, 
which does not change the state at all. Step 4 forces each of the two-qubit states in (Si, S'^^) and (S2, S2) to be in 
the subspace spanned by |<5~) and |^'"*') (as the state must be in this subspace if it is a product of the desirable 
Choi-Jamiolkowski states), which does not change the state either. Then the Swap-Test in Step 5 never fails, 
since the registers (Si, S'^^) and (S2, Sy contain the identical pure state. Finally, Step 6 performs the REFLECTION 
Simulation Test, which must result in acceptance with certainty, as the value q was chosen appropriately so that 
the associated Hermitian operator with this REFLECTION Simulation Test has an eigenvalue exactiy 1/2. 



7 



Verifier's QMA Protocol for Achieving Perfect Completeness with N Prior-Shared EPR Pairs (Simplified) 

1. Store the particles of the shared EPR pairs in (Si, . . . ,S]\f). Receive a quantum witness in registers 

(M,s;,...,s'^). 

2. Execute the DISTILLATION PROCEDURE twice in sequence, both using a state in M. Accept if any of the 
two executions fails, and continue otherwise, with storing the two generated single-qubit states in Ri and R2. 

3. Permute the N pairs of registers (Si, S'^^), . . . , (Sat, S'^) uniformly at random. 

4. Test if the state in (Sj, S^) is in the space spanned by |^^)}, for each j G {1, 2}. Reject if not so, 
and continue otherwise. 

5. Perform the Swap-Test between (Si, S'l) and (S2, S2). Reject if it fails, and continue otherwise. 

6. Perform the REFLECTION Simulation Test with (Ri, R2, Si, S'^^, S2, S2) as input. Accept if this returns 
"accept", and reject otherwise. 



Figure 2: Slightly simplified description of the verifier's QMA protocol for achieving perfect completeness with N 
pre-shared EPR pairs. The complete description appears as Figure[6]in Section |6] 

Rough Sketch of Soundness Analysis Here we give a very rough sketch of the soundness analysis for a no- 
instance case. The rigorous analysis can be found in Section [6l 

Without loss of generality, it is assumed that the original QMA system has soundness exponentially close to 0. 
Then, if none of the two executions of the DISTILLATION PROCEDURE fails, whatever witness has been received 
in Step 1, the state generated in (Ri, R2) after Step 2 must be exponentially close to 

Ixo)ri |xo)r2 = |0)Ri <S) |0)r2 

(and the probabihty that the DISTILLATION PROCEDURE fails is actually exponentially small in this case). This 
implies that the state in (Ri, R2) is almost unentangled with the state in (Si, S'^, . . . , Sat, S'^). 

As the random permutation in Step 3 makes the state in (Si, S'^, . . . , Sat, S'^) symmetric, from the quantum de 
Finetti theorem, the reduced state in (Ri, R2, Si, S'j^, S2, S2) after Step 3 must be close to the state of the form 

(io)(o|)«2^(^p,ef). 
j 

A key property is that the reduced state in (Si, S2) is exponentially close to the totally mixed state (1/2)®^, which 
is guaranteed by the facts that each state in Sj for j G { 1 , . . . N} was originally a half of the shared EPR pair, 
that the two executions of the DISTILLATION PROCEDURE disturbed the state by an at most exponentially small 
amount, and that the state {1/2)®^ in (Si, . . . , Sat) is invariant under random permutation. 

Now one can show that (stated here informally) if the probability of rejection is very small in Step 4 (otherwise 
the dishonest prover is caught with some reasonable probability in this Step 4), the state in (Ri, R2, Si, S'^, S2, Sy 
at the end of Step 4 is sufficiently close to a state of the form 

(|o>(oi)«2^fep;.ef'), 

where is a mixture of the desirable Choi-Jamiolkowski states. 
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Now the Swap-Test in Step 5 intuitively requires that each must be close to some pure state, and thus, if the 
probability of rejection is again very small in Step 5 (otherwise the dishonest prover is caught with some reasonable 
probability in this Step 5), the state in (Ri, R2, Si, S'^, S2, S2) at the end of Step 5 must be sufficiently close to a 
state of the form 



(|0)(0|)®2® 



E 



P"A\J{Wa^)){J{Wa^)\y 



which is a mixture of states of the desired form. 

For each state of the form |0)®2 ® UiWa^))®"^ = |xo)®^ ® UiWa^))'^'^ , however, we know that the REFLEC- 
TION Simulation Test in Step 6 rejects with sufficiently large probability (shown to be exactly 1/16) irrelevant 
to the value aj, and thus, the verifier can reject with probability close to 1/16 even when the verification procedure 
reaches Step 6 with very high probability. 



3 Overview of the Proof of Theorem |4] 

This section gives an overview of the proof of Theorem |4] (or, more precisely, of the formal statement of this 
result. Theorem |25]). which proves the inclusion QlP(m) C QIP]^(m + 1), for each m> 2. For simplicity, here 
we assume that the number m of messages is odd (the case with even number of messages can be proved with 
essentially the same argument), and completeness and soundness are 2/3 and 1/3, respectively, in the original 
quantum interactive proof system. 

The basic idea is again to simulate the REFLECTION PROCEDURE associated with the original m-message 
quantum interactive proof system. 

Fix an input x and the transformations of the prover P on 2; in the original m-message quantum interactive proof 
system. This time, we consider that the register M in the REFLECTION PROCEDURE described in Figure HJcontains 
all the qubits the prover P can access in the original system (i.e., all the private qubits of the prover and all the 
message qubits that are used for communications). We further consider that the register A contains all the private 
qubits of the verifier in the original system. Now, if we replace Vx in Figure [T] by the unitary transformation U 
derived from the original quantum interactive proof system when the verifier communicates with P on input x, 
the Reflection Procedure described in Figured] can be viewed as first applying U by performing a forward 
simulation of the communications with P, then applying a phase-flip with respect to the accepting states, and 
further applying by performing a backward simulation of the communications with P to confirm if the entire 
state does not go back to a legal initial state. 

Hence, if there is a strategy for a prover that can convince the verifier with probabihty exactly 1/2 in the original 
system, then this specific REFLECTION PROCEDURE with such a prover must result in acceptance with certainty, 
from the property of the REFLECTION PROCEDURE. Fortunately, if the number m of messages is at least two, 
it is not hard for an all powerful prover to arbitrarily decrease the accepting probability, and thus, this essentially 
achieves the perfect completeness when the input is a yes-instance. On the other hand, for any no-instance, no 
prover can convince the verifier with probability more than 1/3. This implies that the above specific REFLECTION 
Procedure must result in rejection with some constant probability (actually with probability at least 1/9), again 
from the property of the REFLECTION PROCEDURE. Therefore, this basically establishes a quantum interactive 
proof system of perfect completeness, as desired. 

There are two problems in this construction. One is that a dishonest prover may not be so cooperative that a 
backward simulation forms U'^ as required (i.e., a prover may behave during the backward simulation differently 
from the inverse of what he/she behaved during the forward simulation). The other is that the number of messages 
increases from m to 2m — 1, and thus, it is less communication-efficient than the existing construction of achieving 
perfect completeness in quantum interactive proofs due to Kitaev and Watrous IIKWOOI . 
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Modified Reflection Procedure Both of the two problems mentioned above originate from the fact that the 
Reflection Procedure involves one application of U and one application of U"^. Now we modify the procedure 
so that it involves one application of U"^ only (and no application of U is required), which simultaneously settles 
both of the two problems. 

To do this, at the beginning, one expects to receive a state just after Step 1 of the REFLECTION PROCEDURE, and 
then performs on this state two tests, called REFLECTION TEST and INVERTIBILITY TEST, respectively, with equal 
probability without revealing which test the prover is undergoing. In the REFLECTION TEST, one simply performs 
Steps 2-4 of the REFLECTION PROCEDURE (i.e., one first applies the appropriate phase-flip and then applies U"^) 
to finish the simulation of it. In the INVERTIBILITY TEST, one apply just W without performing the phase-flip and 
checks if the entire state does go back to a legal initial state of the original REFLECTION PROCEDURE. We call 
the resulting procedure the MODIFIED REFLECTION PROCEDURE, a precise description of which will be given 
in Subsection ITT] The idea of making use of the INVERTIBILITY TEST originally appeared in Ref. IIKKMV09II 
when achieving perfect completeness in quantum multi-prover interactive proofs, but the test was used only after 
the forward simulation of the protocol in their original construction, and was not for the purpose of reducing the 
number of messages. 

As is clear from the construction above, the MODIFIED REFLECTION PROCEDURE requires only one appli- 
cation of [/t as desired. Thus, the quantum interactive proof system that simulates this MODIFIED REFLECTION 
Procedure involves only m messages as required (for an even m, it involves m + 1 messages, as the original 
system starts with a turn for a verifier, while the verifier in the constructed system needs to receive a witness before 
his/her first turn). Moreover, for any yes-instance, the honest prover clearly has only to cooperate with the verifier 
to perform the backward simulation of the original REFLECTION PROCEDURE and can convince the verifier with 
certainty. On the other hand, for any no-instance, the original REFLECTION PROCEDURE would have rejected 
with high probability, if the proper U"^ were performed. Thus, if the backward simulation in the MODIFIED RE- 
FLECTION Procedure were properly performed, the Reflection Test of it could reject with high probability 
as it properly simulates the original REFLECTION PROCEDURE. In contrast, if the backward simulation were not 
proper in the MODIFIED REFLECTION PROCEDURE, then the INVERTIBILITY Test of it would result in rejection 
with high probability, as it essentially forces the prover to perform a proper backward simulation of the original 
Reflection Procedure. Indeed, as will be proved in Subsection [TTl if one starts with a Reflection Pro- 
cedure that rejects with probabihty at least e for every possible witness, the resulting Modified Reflection 
Procedure rejects with probability at least e/4 no matter which witness is received (the proof of Proposition [30l 
essentially proves this). Hence, the soundness can be shown as well in the MODIFIED REFLECTION PROCEDURE. 

4 Preliminaries 

Throughout this paper, let N and Z"*" denote the sets of positive and nonnegative integers, respectively, and let 

5 = {0, 1} denote the binary alphabet set. A function /: Z+ — )■ N is polynomially bounded if there exists a 
polynomial-time deterministic Turing machine that outputs on input 1". A function /: Z+ — )• [0, 1] is neg- 
ligible if, for every polynomially bounded function g: Z+ — N, it holds that f{n) < l/g{n) for all but finitely 
many values of n. 

Quantum Fundamentals We assume the reader is familiar with the quantum formalism, including pure and 
mixed quantum states, density operators, measurements, trace norm, fidelity, as well as the quantum circuit model 
(see Refs. IINCOOi IKSV021 . for instance). Here we summarize some notations and properties that are used in this 
paper. 

For each fc E N, let C(S^) denote the 2^^ -dimensional complex Hilbert space whose standard basis vec- 
tors are indexed by the elements in S^. In this paper, all Hilbert spaces are complex and have dimension a 
power of two. For a Hilbert space Ti, let /-^ denote the identity operator over T-L, and let D(?^) be the set 
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of density operators over T-L. For a quantum register R, let |0)r denote the state in which all the qubits in 
R are in state |0). As usual, denote the two single-qubit states in C(S) that form the Hadamard basis by 
1+) = ^(|0) + |1)) and |-) = ^(|0) - and the four two-qubit states in C{T?) that form the Bell ba- 

sishy |$+) = ^(|00) + 111)), 1$-) = ^(|00) - 111)), \^+) = ^(|01) + |10)), and |^-) = ^(|01) - |10)), 
respectively. Let i7 = -1= ( j ) denote the Hadamard operator, and let X = ( 5 o ) ^"^^ Z = ( o -i ) denote the 
Pauli operators. For convenience, we may identify a unitary operator with the unitary transformation it induces. In 
particular, for a unitary operator U, the induced unitary transformation is also denoted by U. 

For a linear operator A, the trace norm of A is defined by ||j4||tr = trV A"^ A. For two quantum states p and a, 
the trace distance between them is defined by D{p, a) = \\p — (T||tr/2, and the. fidelity between them is defined by 
F{p,a) = tx^J^Jpa^Jp. A special case of the trace distance is the statistical difference between two probability 
distributions p and v, which is defined by SD(/i, i/) = D{p,h') by viewing probability distributions as special 
cases of quantum states with diagonal density operators. We will use the following important properties of the 
trace distance and fidelity. 

Lemma 6. Let pp and pa be the probability distributions derived from two quantum states p and a, respectively, 
by performing an arbitrary identical measurement. Then, SD(//p, pa) < D[p, a). 

Lemma 7 ( IISR021lNS03l ). For any quantum states p, a, and F{p, ct)^ + F{a, S,)^ < 1 + F{p, ^). 

For any unitary transformation U acting over the two-dimensional Hilbert space T-L = C(S) (i.e., the single- 
qubit space), the Choi- Jamiolkow ski state of U is the two-qubit state inl-L ^T-L = defined by 

\J{U)) = {I®U)\^+). 

In fact, the Choi-Jamiolkowski state can be defined for any admissible (and not limited to unitary) transformation 
and any finite-dimensional Hilbert space, using the Choi-Jamiolkowski representation IIJam721ICho75ll . but which 
is unnecessary in this paper. 

The Finite Quantum de Finetti Theorem For G N and quantum registers Qi, . . . , Qat, each consisting of 
k qubits, an A^-partite quantum state p in (Qi, . . . , Q^r) is said to be symmetric if p is invariant under any permu- 
tation over the registers Qi, . . . , Q^r. 

The finite quantum de Finetti theorem IIKR05I ICKMROTl provides a very useful property that the reduced 
m-partite state of any A^-partite symmetric state when tracing out the last N — m subsystems must be close to a 
mixture of m-fold product states. This paper uses the following bound proved in Ref. IICKMR07II . 

Theorem 8 (The finite quantum de Finetti theorem). For N,k £ N, let Qi, ... , Qn be quantum registers each 
consisting of k qubits, and let p be an N -partite symmetric state in (Qi, . . . , Q^r). For any m € N satisfying 
m < N and the m-partite reduced state p^*"^ of p in (Qi, . . . , Qm), there exist C G N, a set {S,j}je{i,...,C} "/ 
k-qubit states, and an associated probability distribution {pj}je{i,...,c} -^wc/i that 




Polynomial-Time Uniformly Generated Families of Quantum Circuits Following conventions, we define 
quantum Merlin-Arthur proof systems in terms of quantum circuits. In particular, we use the following notion 
of polynomial-time uniformly generated families of quantum circuits. 

A family {Qx} of quantum circuits is polynomial-time uniformly generated if there exists a deterministic pro- 
cedure that, on every input x, outputs a description of and runs in time polynomial in |a;|. It is assumed that 
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the circuits in such a family are composed of gates in some reasonable, universal, finite set of quantum gates. Fur- 
thermore, it is assumed that the number of gates in any circuit is not more than the length of the description of that 
circuit. Therefore Qx must have size polynomial in For convenience, we may identify a circuit Qx with the 
unitary operator it induces. 

Throughout this paper, we assume a gate set with which the Hadamard and any classical reversible transfor- 
mations can be exactly implemented. Note that this assumption is satisfied by many standard gate sets such as the 
Shor basis [,Sho96,l consisting of the Hadamard, controUed-z-phase-shift, and Toffoli gates, and the one consisting 
of the Hadamard, Toffoli, and NOT gates IIShi02[ lAha03ll . Moreover, as the Hadamard transformation in some 
sense can be viewed as a quantum analogue of the classical operation of flipping a fair coin, our assumption would 
be the most natural quantum correspondence to the tacit classical assumption in randomized complexity theory that 
fair coins and perfect logical gates are available. Hence we believe that our condition is very reasonable and not 
restrictive. Note that, with a gate set satisfying this assumption, any transformation corresponding to a Clifford 
group operator is exactly implementable. In particular, the controlled-phase-flip transformation Z can be exactly 
realized by using an ancilla qubit prepared in state |— ) = "^(|0) — |1)) (by applying a NOT and an Hadamard in 
sequence to |0)) and performing a CNOT with this ancilla as the target. 

Since non-unitary and unitary quantum circuits are equivalent in computational power IIAKN98II . it is suffi- 
cient to treat only unitary quantum circuits, which justifies the above definition. Nevertheless, for readability, most 
procedures in this paper will be described using intermediate projective measurements and unitary operations con- 
ditioned on the outcome of the measurements. All of these intermediate measurements can be deferred to the end 
of the procedure by a standard technique so that the procedure becomes implementable with a unitary circuit. 

Quantum Interactive Proof Systems Now we review the model of quantum interactive proof systems. 

A quantum interactive proof system is a communication model between two players called a quantum verifier V 
and a quantum prover P, both of whom receive a common input x G S*. Fix the input x. Let V and P be 
quantum registers corresponding to the private spaces of V and P, respectively, and let M be a quantum register 
corresponding to the message space that is used to exchange messages between V and P. One of the qubits in V, 
which is private to V, is designated as the output qubit. At the beginning, all the qubits in V and M are initialized 
to state 1 0) , while the quantum state in P can be arbitrarily prepared by P. Then V and P together run a protocol 
that consists of alternating turns of the verifier and of the prover. The first turn is for the verifier if the total number 
of turns is even, and it is for the prover otherwise, whereas the last turn is always for the prover. At each turn of the 
verifier, V applies some unitary transformation implementable with a polynomial-size quantum circuit to the state 
in (V, M), and then sends the register M to P. At each turn of the prover, P applies some unitary transformation 
to the state in (P, M), and then sends M to y. After the last turn, the verifier V further applies some unitary 
transformation implementable with a polynomial-size quantum circuit to the state in (V, M), and then measures the 
output qubit in the standard basis. V accepts if this measurement results in 1 1) and rejects otherwise. 

Formally, for any polynomially bounded function m : Z+ — N, an m-message polynomial-time quantum ver- 
ifier is a polynomial-time computable mapping y : S* — )• S*. For each input x G S*, V{x) is interpreted as de- 
scribing a series {yr,j}je{i,...,[(m(|x|)+i)/2]} of quantum circuits acting over the same number of qubits as well 
as a partition of the qubits on which these circuits act into registers V and M, where {V^j} is a polynomial- 
time uniformly generated family of quantum circuits explained in Section |4] (in particular, every circuit Vxj is 
composed of gates in some reasonable, universal, finite set of quantum gates). For any polynomially bounded func- 
tion m : Z+ — )• N, an m-message quantum prover is a mapping P that simply maps an input binary string x G S* 
to a series {i^x,j}je{i,...,[(m(|x|)+i)/2j} of unitary transformations as well as apartition of the qubits on which these 
unitary transformations act into registers M and P. It is always assumed that V and P are compatible (i.e., the 
register M is common for V and P) when they are associated with the same quantum interactive proof system. 

Given an input x, an m-message polynomial-time quantum verifier V, and an m-message quantum 
prover P, let Qx be the unitary transformation induced from V and P, acting over the space correspond- 
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ing to (V, M, P): Q^ = ^xXm{\x\)-v\)l'i ® h){Iv Px,{mi\x\)+i)/2) • • • {Vx,i IvWv ® Px,i) if m{\x\) is odd, 
while = (^xs(m{|ai)/2)+i '^^p)(-^v «'^'x,m(|ai)/2)(Kism(|x|)/2 ® -^p)--- (-^v ^li^x.OCKsi ® /p) if m{\x\) is 
even, where V and V are the Hilbert spaces corresponding to V and P, respectively. When communicating with 
the prover P who prepares the initial state p G D(T'), the verifier V accepts the input x if the measurement of the 
designated output qubit in V in the standard basis results in |1) at the end of the protocol after having applied the 
unitary transformation Qx to the initial state |0)(0|(v,M) "SD P in (V, M, P). 

Formally, the class QIP(?ti, c, s) of problems having m-message quantum interactive proof systems with com- 
pleteness c and soundness s is defined as follows. For generality, throughout this paper, we use promise prob- 
lems IIESY84II rather than languages when defining complexity classes. 

Definition 9. Given a polynomially bounded function m: Z+ — N and functions c,s: Z+ — )• [0,1] satisfying 
c > s, a promise problem A = (^ycs, ^no) is in QIP(m, c, s) iff there exists an m-message polynomial-time quan- 
tum verifier V such that, for every input x: 

(Completeness) if x G Ayes, there exist an m-message quantum prover P and the initial state px of P that make V 
accept X with probability at least c(|3;|), 

(Soundness) if x G A^o, for any m-message quantum prover P' and any initial state p'^ of P' prepared, V accepts 
X with probability at most s(|x|). 

The class QlP(m) of problems having m-message quantum interactive proof systems is defined as follows. 

Definition 10. Given a polynomially bounded function m: Z+ — )• N, a promise problem A = (Ayes,^no) is in 

QlP(m) iff A is in QIP(m, 1 — e, e) for some negligible function s: Z+ — > [0, 1]. 

Similarly, the class QIP^ (m) of problems having m-message quantum interactive proof systems of perfect 
completeness is defined as follows. 

Definition 11. Given a polynomially bounded function m: Z+ — N, a promise problem A = (Ayes,^no) is in 

QlPi(m) iff A is in QIP(m, l,e) for some negligible function e: Z+ — [0, 1]. 

Finally, as quantum Merlin-Arthur proof systems are nothing but one-message quantum interactive proof sys- 
tems, the classes QMA and QMA^^ of problems having quantum Merlin-Arthur proof systems and those of perfect 
completeness are simply defined as follows, respectively. 

Definition 12. A promise problem A = {Aycs,Ano) is in QMA iff A is in QIP(1, 1 — e,e) for some negligible 
functions: Z+ [0,1]. 

Definition 13. A promise problem A = (^yes,^no) is in QMA^ iff A is in QIP(1, l,e) for some negligible 
functions: Z+ ^ [0, 1]. 

Quantum Merlin-Arthur Proof Systems with Shared EPR Pairs We further introduce another variant of the 
quantum Merlin-Arthur proof systems in which Arthur and Merlin initially share some copies of the EPR pair |$^). 
If Arthur and Merlin are allowed to share k EPR pairs initially, the resulting systems are called quantum Merlin- 
Arthur proof systems with k shared EPR pairs, or k-EPR QMA proof systems in short. Notice that this model is 
actually equivalent to a special case of two-message quantum interactive proof systems in which the first transfor- 
mation of a verifier is just to create k copies of the EPR pairs (and k halves of these EPR pairs are sent to a prover 
as the first message). 

Formally, the class QMA'^'"^^^(c, s) of problems having quantum Merlin-Arthur proof systems with k shared 
EPR pairs with completeness c and soundness s is defined as follows. 
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Definition 14. Given a polynomially bounded function k: Z+ — N and functions c,s: Z+ — [0, 1] satisfying 
c> s, a promise problem A = (j4yes,^no) is in QMA'^"^^^(c, s) iff A has a two-message quantum interactive 
proof system with completeness c and soundness s in which, for every input x, the first transformation of the 
associated quantum verifier is just to create k{\x\) copies of EPR pairs and the first message from the verifier 
consists only of the k{\x\) halves of these EPR pairs. 

We further define the class QMA'^°'^'^*"^^^ of problems having quantum Merlin-Arthur proof systems with 
a constant number of k shared EPR pairs with constant gap between completeness and soundness and the 
class QMA™'^'^*"^^^ of problems having those of perfect completeness with constant soundness error as follows. 

Definition 15. A promise problem A = (^yes, A^o) is in QMA'=°'^"*-^p^ iff ^ is in QMA*^-^p^(2/3, 1/3) for some 
constant A; G N. 

Definition 16. A promise problem A = (Ayes, ^no) is in QMA^"'^'^*-^^^ iff A is in QMA^-^P^(1, 1/2) for some 
constant A; G N. 

Remark. Definitions [15] and [16] are equivalent to the seemingly most conservative defini- 

tions QMA--t-EPR UfceN,o<.<c<i QMA'=-epi^(c, s) and QMA5°-*-epR 41^ UfceN,.e[o,i) QMA^-epR(1, s) of 
these classes, for repeating the associated system with each of these classes constant times can achieve arbitrarily 
large constant gap between completeness and soundness (in the two-sided error case, one first achieves sufficiently 
large completeness via a parallel repetition followed by a threshold value computation, and then achieves desirably 
small soundness via another parallel repetition of the obtained large-completeness system, without decreasing the 
completeness too much). 



5 Reflection Procedure 

We start with presenting a very simple base procedure, which we call the REFLECTION PROCEDURE, that forms 
a very base of our protocols to be constructed - basically, our protocols aim to simulate this base procedure with 
several suitable modifications. 

Let Ti be some Hilbert space, and consider two decompositions of T-L into Xq © Xi and 3^o © for sub- 
spaces Xq, Xi, y^, and yi of T-L. Let Aj be the projection over T-L onto the subspace Xj and let Hj be that onto y,-, 
for each j G {0, 1}. 

Let U be some unitary transformation acting over T-L, and let M be the Hermitian operator over T-L defined by 

M = Aot/"fnoC/Ao. 

Suppose that M has an eigenvalue A > and consider the eigenstate (i.e., the normalized eigenvector) |i;^o) corre- 
sponding to A. Then, M\4)q) = \\4>q), and thus, 

Ao|</<o) = ^AoM|(/)o) = \m\4>o) = Ic/'o). 
Define the four states I'^o), IV'i)' I Co), and in ^ as follows: 

IioU\<j,o) ni^|0o) Ao^t|^Q) AiC/t|V;o) 



|no[/|</)o)||' l|nif/|0o)ll' l|Aot/t|^o)ll' IIAimiV'o)!!' 

Then, ||noC/|(/)o) || = ||nof/Ao|</'o)|| = ^/JM^d\^ = \/A, and thus, ||niC/|(^o)|| = VT^. It follows that 
||Ao[/Vo)|| = -^||Ao?7tnoC/|(/)o)|| = -^||Aoi7tnoC/Ao|0o)|| = ^||M|0o)|| = A 



14 



Reflection Procedure 

1. Receive a quantum register Q. Reject if the state in Q does not belong to the subspace corresponding to the 
projection Aq, and otherwise apply U to Q. 

2. Perform a phase-flip (i.e., multiply —1 in phase) if the state in Q belongs to the subspace corresponding to 
the projection IIo. 

3. Apply C/t to Q. 

4. Reject if the state in Q belongs to the subspace corresponding to Aq, and accept otherwise. 



Figure 3: The REFLECTION PROCEDURE. 

and thus, ||AiC/t|^o>|| = \/l - A. Hence, 

l^o) = -^AoC/^o) = ^AoC/tnoC/|</.o) = iAoC/tno[/Ao|0o) = \m\^o) = l^o), 

and thus, 

u^\4^o) = Vxm + VT^\^i), t/^IVi) 

which was the crucial property analyzed by Marriott and Watrous 
amplification technique. 
It follows that 

C/t(-no + Ui)U\^o) = U^{-Vxm + VT^li'i)) = (l - 2A)|eo) - 2VA(1-A)|a), 

and thus, when M has an eigenvalue 1/2, the corresponding eigenstate (which is necessarily in Xq) must be 
transformed into a state in Xi after the following process: one first applies U to \(/)o), next flips the phase of states 
in 3^0 applies the unitary transformation —Ho + Hi), and then applies U^. This property can be used to test if 
M has an eigenvalue 1/2, which is summarized in Figure [3l 

Proposition 17. If the Hermitian operator M = Aq^/^IIoC/ Aq has an eigenvalue 1/2, there exists a quantum state 
given in Step 1 of the REFLECTION PROCEDURE such that the procedure results in acceptance with certainty. 

Proof. Consider the case where the eigenstate of M with its corresponding eigenvalue 1/2 is received in Q in 
Step 1. Then the claim is immediate from the argument above. □ 

Proposition 18. For e > 0, suppose that none of the eigenvalues of the Hermitian operator M = AoC/^Hot/Ao is 
in the interval ~ ^ + s)- Then, for any quantum state given in Step 1 of the REFLECTION PROCEDURE, the 
procedure results in rejection with probability at least 4e^. 

Proof. Let be any state received in Q in Step 1. Without loss of generality, one can assume that is in Xq (as 
otherwise either rejected in Step 1 or projected onto a state in Xq). 

For the Hilbert space T-L, there always exists an orthonormal basis such that all the basis states of it are eigen- 
states of M, and thus, the state can be necessarily written as |^/;) = X]j=i ^j\4'j) for d = dim < dim'H, 
where each \(t)j) is an eigenstate of M in Xq and X]^=i lo^iP — ^■ 

From the analysis above, every eigenstate of M in Xq with corresponding eigenvalue \j > must satisfy 

that 

AoC/t(-no + Ili)U\(l)j) = (1 - 2A,-)|0,>. 



IIMW05II to develop their space-efficient QMA 
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On the other hand, for every eigenstate of M in Xq with corresponding eigenvalue Aj = 0, 

||noC/|(/>j)|| = ||noC/Ao|0j)|| = ^/{(l)j\M\4)j) = O, which implies IliU\(l3j) = f/|(/>j), and thus 

Aof/^(-no + Ili)U\(t>j) = Ao|(Ai> = \<t^j) = (1 - 2A,-)l0j>- 

Therefore, 

d 

Aot/t(-no + ni)C/|V^) = 5^a,-(l - 2A,)|<Ai>, 

J=l 

and thus, the probability of rejection is at least X]j=i l<^iP(l ~ ^A-,)^ > Ae^ Z]j=i — 4^^> as claimed. □ 

6 QMA C QMAf C QIPi(2) 

The goal of this section is to prove Theorem[2l In Subsection |6.1| we first describe building blocks, before presenting 
the proof in Subsection 16.21 

6.1 Building Blocks 

6.1.1 Encoding Accepting Probability in Phase 

Let V be the verifier of a certain QMA system. Consider the quantum circuit Vx of V when the input is x, 
which acts over a pair of two registers A of qubits and M of m(|a;|) qubits, for some polynomially bounded 

functions f , m : Z+ — )• N. The circuit Vx expects to receive a quantum witness of m(|x|) qubits in register M, and 
uses the v(\x\) qubits in A as its work qubits. The Hilbert spaces associated with A and M are denoted by A and 
M., respectively. 

For an input x, let "Px be the maximum acceptance probability of the verifier V in this QMA system. Then, 
as pointed out by Marriott and Watrous IIMW05I . 'Px corresponds to the maximum eigenvalue of the Hermitian 
operator 

Mx = HinitK^nacc't^xninit, 

where Ilinit is the projection onto the subspace spanned by states in which all the qubits in A are in state 1 0) , and 
Ilacc is that onto the subspace spanned by accepting states of this QMA system. Let \'Wx) be the eigenstate (i.e., 
eigenvector) of Mx corresponding to the eigenvalue px- A crucial analysis of Ref. IIMW05II (which essentially 
follows from the arguments in Section [S]) is that 

Ilinit V'J"nacc"14(|0)A ® \Wx)u) = Px\^) h ® \Wx)u, 
ninitK^nrcjK.-(|0)A ® \Wx)m) = (1 -Px)|0)a ® \Wx)m, 

where Hrej = Ia®M ~ Ilacc is the projection onto the subspace spanned by rejecting states of this QMA system. 

Let p = p\l {2p\ — 2px + 1). Using the property explained above, if one copy of \wx) is given, one can gener- 
ate with high probability the state 

as follows. One uses a single-qubit register R in addition to A and M, where one sets \wx) in M, and initializes all 
the qubits in A and R to state |0). First, one performs a forward simulation of the original system over A and M 
(i.e., applies Vx to (A, M)), and flips the qubit in R if the content of (A, M) corresponds to an accepting state of the 
original system (i.e., applies the unitary transformation X Ilacc + I ® Hrej to (R, A, M)). One then performs a 
backward simulation of the original system over A and M (i.e., applies Vx to (A, M)). Now one measures all the 
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Distillation Procedure 

Input: a single-qubit register R, a w(|x|)-qubit register A, and an m(|x|)-qubit register M. 
Output: a single-qubit register R or a symbol _L. 

1. ApplyK«to(A,M). 

2. Flip the qubit in R if the content of (A, M) corresponds to an accepting state of the original system. 

3. Apply Vi to (A, M). 

4. Measures all the qubits in A in the computational basis. If any of these measurements result in 1 1), output _L, 
otherwise output R. 



Figure 4: The DISTILLATION PROCEDURE. 

qubits in A in the computational basis. If no |1) is measured (i.e., if the state is projected with respect to Ilinit. 
which happens with probability — 2px + 1), the unnormalized state in the system must be 

|0)r ® (1 -p^)|0)a ® \w^)m + \1)r®Px\Q)a ® \wx)m = [(1 - VxM +Px\l)] R ® |0)a ® k^)M, 

and thus, the desired state is successfully generated in R. We call this procedure the DISTILLATION PROCEDURE, 
which is summarized in Figure |4l 

6.1.2 Multiplicatively Adjusting Accepting Probabilities 

For a real number a G [0, 1], let Wa be the unitaiy transformation defined by 

"-.^(^ .^)- 

Given a unitary transformation Wp for some real number p G [i, l] , we construct another unitary transforma- 
tion U and an appropriate projection operator Hq acting over two qubits so that the probability ||no?7|00) |p exactly 
equals 1/2. 

Suppose that one can apply another unitary transformation Wq, for some real number g G [0, 1], and define the 
unitary transformation U and projection operator Ho by 

u = Wp®Wq, no = |ii)(ii|. 

Then, clearly, ||noC/|00)|p = pq, and thus, this probability equals 1/2 if and only if pq = 1/2. This in particular 
implies that there exists a real number q G [0, 1] that achieves the adjusted accepting probability exactly 1/2 when 
p > 1/2, but no g G [0, 1] can make it exactly equal to 1/2 whenp < 1/2. 

6.1.3 Simulating Unitaries with Choi-Jamiolkowski States 

In this subsection, we consider the case where the aforementioned unitary transformation Wa itself is not available, 
but only the copies of its Choi-Jamiolkowski state \ J{Wa)) = (/ (E> Wa)|*^^) are available. 

Note that one copy of the Choi-Jamiolkowski state | J(Wa)) can be used to simulate one application of Wa (the 
simulation succeeds with probability 1/4). More precisely, the simulation of Wa is done as follows. Suppose one 
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wants to apply Wa to the qubit in some single-qubit register Ri, wtiile the state \ J{Wa)) is available in (R2, R2), 
for some single-qubit registers R2 and Rg. Then one measures the state in (Ri, R2) in the Bell basis. If this results 
in 1$^), the application of Wa succeeds, and the desired state is available in the register Rg (which can be verified 
via an argument similar to the analysis of seminal quantum teleportation). 

In fact, when one wants to apply Wa to the specific state 1 0) , there is a more efficient way than the simulation 
just explained above. A key observation is that, for any real number a G [0, 1], the unitary transformation Wa in 
the last subsection can be written as 

"-"-(^ _;(^) = ^^ + v^^. 

and thus, the state \xa) is given by 

\Xa) = Wa\0) = VT^\0) + ^Ja\l), 

while the Choi-Jamiolkowski state of Wa is given by 

\J{Wa)) = VT^\J{z)) + V^\J{x)) = VT^\^-) + 

Hence, given one copy of the Choi-Jamiolkowski state \ J{Wa)), one can easily generate the state \xa) = W^a|0) in 
the first qubit by applying the following unitary transformation T to \J{Wa))- 

T: |$") |00), |^'")h^|01), |^'+)h^|10), |^>+)h^|ll) 

(note that this T can be realized by first applying the CNOT transformation using the first qubit as the control, then 
applying the Hadamard transformation H and the NOT transformation X in this order to the first qubit, and finally 
applying CNOT again using the first qubit as the control). 

6.1.4 Simulating the Reflection Procedure with Choi-Jamiolkowski States 

Now we consider simulating the REFLECTION PROCEDURE with given two copies of \xp) = Wp\0) and two copies 
of a Choi-Jamiolkowski state \ J(Wq)), where p and q are real numbers in [0, 1]. The procedure basically follows 
the Reflection Procedure with taking the register Q to be a two-qubit register, the initial state \(po) to be |00), 
the projection Aq to be |00)(00|, and the underlying unitary U and projection IIo to be Wp ® Wq and 
as defined in Subsection 16.1.21 Thus, to precisely perform the REFLECTION PROCEDURE in Figure [3] in this 
setting, we need to apply each of Wp = Wp and Wq = Wq twice. Fortunately, each of the first applications of 
Wp and Wq is to the |0) state, and thus, one may simply replace these applications by just using a given copy of 
\Xp) and generating \xq) from a copy of \J(Wq)), respectively. The second applications of these unitaries can 
be probabilistically simulated by using the Choi-Jamiolkowski states | J(Wp)) and \J{Wq)), where one creates 
\J{Wp)) from a copy of \xp)- This leads to the procedure called REFLECTION SIMULATION TEST described in 
Figure |5] 

Now we analyze the properties of this simulation. 

Proposition 19. The REFLECTION SIMULATION TEST accepts with certainty if the state in the input regis- 
ter (Ri, R2, Si, S'^, $2, S2) is Ixp)*^^ ® \ J {Wq))^"^ f*^^ some real numbers p,q & [0, 1] satisfying pq = 1/2. 

Proof. The claim is almost obvious. With \xp) in Ri and \ J{Wq)) in (Si,S'^) for such p and q, Step 1 in the 
Reflection Simulation Test creates the state 

um = (yr^io) + vp|i))r, » (\/r^io) + vq\'^))s. 
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Reflection Simulation Test 
Input: single-qubit registers Ri, R2, Si, S'^, S2, and Sg. 
Output: "accept" or "reject". 

1. Receive six single-qubit registers Ri, R2, Si, S'^^, S2, and S2. 
Apply the unitary transformation T to the state in (Si, S'^^). 
Prepare |0) in a single-qubit register Rj. 

2. Perform a phase-flip (i.e., multiply —1 in phase) if (Ri, Si) contains 11. 

3. Try to simulate Step 3 of the REFLECTION PROCEDURE by performing the following: 

Apply T"^ to the state in (R2, R2)- Measure the states in (Ri, R2) and (Si, S2) in the Bell basis. Continue if 
both of these two measurements result in \^^), and accept otherwise (accept with giving up due to failure of 
the simulation). 

4. Reject if (R2, S2) contains 00, and accept otherwise. 



Figure 5: The REFLECTION Simulation Test, which tries to simulate the Reflection Procedure using 
Choi-Jamiolkowski states. 

in (Ri, Si), since the application of T generates the state \xq) in Si. As the application of T"^ in Step 3 gener- 
ates the Choi-Jamiolkowski state \ J{Wp)) in (R2, R2), one succeeds in Step 3 with probability (1/4)^ = 1/16 
in applying both of Wp = Wp and Wg = Wq, which successfully simulates U"^ with generating the de- 
sired state in (RgjSg). Hence, the simulation of the REFLECTION PROCEDURE succeeds with probabil- 
ity 1/16, in which case the test necessarily results in acceptance as in the analysis in Section [5] since 
(|00)(00|[/tno?7|00)(00|)|00) = ||no?7|00)f |00) = i|00). On the other hand, if any of measurements in Step 3 
fails in measuring |$^), the test just stops and accepts with giving up. Therefore, the test must result in acceptance 
with certainty. □ 

Proposition 20. The Reflection Simulation Test results in rejection with probability 1/16 if the state in the 
input register (Ri, R2, Si, S'l, S2,S2) is jO)*^^ ® \J{Wq))®'^ for any real number q G [0, 1]. 

Proof With |0) in Ri and | J(Wg)) in (Si, S'J, Step 1 in the REFLECTION Simulation Test creates the state 

|0)ri » |Xg)Si 

in (RijSi). For this state given. Step 2 in the REFLECTION SIMULATION TEST does not change the state in 
(Ri,Si) at all. As |0) = |xo)> the application of in Step 3 generates the Choi-Jamiolkowski state \ J{Wo)) 
in (R2, R2), and thus, one succeeds in Step 3 with probability (1/4)^ = 1/16 in applying both of Wq = Wq and 
Wq = Wq. If such an event occurs, the State in (R'g, S2) becomes |0)r^ Cg) |0)s'^, and thus, the test results in rejection 
with certainty. 

Taking it into account that the test just stops and accepts with giving up when any of measurements in Step 3 
fails in measuring |<&^), the test results in rejection with probability 1/16 in total. □ 

6.2 Proof of Theorem H 

We first show the following lemma. 
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Lemma 21. For each j € {1, 2}, let Sj and Sj be two-dimensional complex Hilbert spaces C(S), and let Wj 
be the two-dimensional subspace of Sj ® S'^ spanned by |$^) and |^^). Let p be any four-qubit state in 
D(Wi ® W2) ^ D(5i ® S'i(^ S2® S'2) that is a mixture of two-fold product pure states ICj)*^^ in Wi ® W2 
and such that ^(tr^/^^^p, {1/2)®'^) < e. Then there exists a four-qubit state a that is a mixture of two-fold prod- 
ucts \ J {Waj))^^ of a Choi- Jamiotkowski state, for real numbers aj G [0,1], such that D{p, a) < (32£)3. 

Proof. As p is a mixture of two-fold product pure states in Wi ® W2, it must be written as 

where \Cj)^^ € Wi (8) W2 and pj G [0, 1] for each j, and J2j l^j = 1- Without loss of generality, one may assume 
that 

for each j, where aj and /3j are real numbers in [0, 1] satisfying aj + f3j = 1, and 6j is a real number in [0, 27r). 
For each j, let aj = Pj, and define the two-qubit pure state \rij) as 

and take the four-qubit state a as 



We shall show that this a has the desired property. For this purpose, we give the two claims. 
Claim 1. (tr5,^5,p, (1/2)^2) > 2 E, /x,a2^2gi^2^._ 

Proof Noticing that 

1 



10) = ^[a,(|00) - 111)) +^,e'^^(|01) + |10))] 
1 



-ie 



= ^[(a,|0) + /3,e''^l)) |0) + e^'^{Pj\0) - 

the reduced state tr^/^^/ p is the mixture of the following four states 

iaj\0) + Pje^'^l)) (a,|0) +/3,e*^^|l)), 
(a,|0)+/3,e^^:'|l))^(/3,|0)-a,e-*^^|l)), 
(/3,|0)-a,e-*^^|l))^(a,|0)+/3,e*^^|l)), 
(/3,|0) - a,e-''^l)) (/3,|0) - a,e-^^|l)) 

with equal probabihty 1/4 for each, which can be expressed as a density matrix by 



'^|1»»|1>], 



/ 1 

2iajl3jSj 



1 



2iajpjSj 
1 

2iajPjSj 2iajPjSj 



-2iaj(3jSj 
-2iajj3jSj 

1 y 
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where Sj is the shorthand of sinOj. Thus, the difference between tr^/igi^/p and (7/2)®^, denoted by A, is given by 



A = 



-2i HjajPjSj -2i ^ijaj(3jSj -4 l^jap]s] \ 



2«2 2 
j 



V-4Ej/^j«?/3fs^ 2ij2iH(^jPjSj '^iJ2jmPjSj 



-2i^jHjajPjSj 
-2i^jHjajpjSj 

y 



Now we solve the characteristic equation |2A — A/| = to find eigenvalues of 2 A. Calculating the determinant, 
we have 



\2A - XI\ = 



-A 



i^jm^jSj 2 Ej -A -i^jWPjSj 

-2^-fijap]s] iT.jm(ijSj iEjH^il^jSj 



X + 2^fijap]s 



A^ 



4A ^ + 4 ( ^ Hf^pjs'j ] - wPjS. 



Thus the four solutions of the equation |2A — AI|=0 are given by —2J2jl^j(^]PjSj (two-fold) and 
2 Ej l^j'^'jf^j^'j ^ 2|Ej l^j'^jPj^jl' which are the eigenvalues of 2 A. This imphes that 
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2 

j j j 



+ 



which is at least 2 Ej f^j'^jf^j'^j- This completes the proof. □ 

Claim 2. Le? {pj} Z^e a probability distribution, and {cj} Z^e a set of real numbers such that \cj\ < 1. If 
^jPjCj < 5. it holds that Ej^^ikil ^2(^3. 

Proo/ Let ^ = (i : c| < (55 }. Note that Ej^A^'j ^ since 



Thus, using \cj\ < 1, we have 



j jeA jeA j^A 



as claimed. 

Now we bound D{p, a). Notice that 



□ 
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Since 

{\iCjh)fy = + /3je"'^^ ff = ((a| + f3j cos%)^ + {f3] sinOj^Y = (l - 2ap] sin^ Ojf, 
we have 

^1 - (|(OI??j)|^)^ = 2| aj/3j sin 9j \ - ap] sin^ Oj < 2\ajPj sin Oj \ . 

Therefore, 

D{p,cr) < 2 /ij I aj f3j sin 0j | . 

j 

By Claimdl the assumption ^^(tr^/gj^/p, (7/2)'^^) < e imphes that 

J]/.,a2/32sin2 0, <|. 
i 

By Claim|2l this implies that D{p, a) < 4(|)^ = (32e)5, which completes the proof of Lemma |2T] □ 

Now we are ready to prove Theorem |2l 

Proof of Theorem^ Let A = (^yes, ^no) be in QMA and let V be the verifier of the corresponding QMA system. 
Without loss of generality, one can assume that both completeness and soundness errors are exponentially small in 
this QMA system. 

For an input x, the quantum circuit Vx of the verifier V acts over a pair of two registers A of v{\x\) qubits 
and M of m(|x|) qubits, for some polynomially bounded functions v,m: Z+ — N. This can be interpreted as Vx 
expecting to receive a quantum witness \w) of m(|x|) qubits in register M, and uses the v{\x\) qubits in A as its 
work qubits. By Refs. IIShi021 IAha031. one can further assume that the quantum circuit Vx for any input x consists 
of only the Hadamard, Toffoli, and NOT gates. As pointed out by Marriott and Watrous |MW05|, the maximum 
acceptance probability px of V with input x corresponds to the maximum eigenvalue of the Hermitian operator 

Mx = HinityJnaccKninit, 

where Hinit is the projection onto the subspace spanned by states in which all the qubits in A are in state |0), and 
Ilacc is the projection onto the space spanned by the accepting states of V . From this verifier V , we shall construct 
a protocol for the verifier W of another QMA system in which W shares EPR pairs a priori with a prover 
communicating with, where is a constant that is a power of two. 

Our basic strategy is to try to perform the REFLECTION Simulation Test using Vx- Fix an input x, and 

2 

let p = 2pi-2p +1 - L^*- Si, . . . , Sat be single-qubit registers which stores the particles of the shared EPR pairs. 
In addition to M, receives A^ single-qubit registers S'^, . . . , S'^. W expects to receive in M the state \wx) that 
is the eigenstate (i.e., eigenvector) of Mx corresponding to the eigenvalue px, and to receive states in S'^^, . . . , S'^ 

2 

such that the state in {Sj,S'j) forms \ J{Wq)) for each j G {1, . . . , A^}, for q satisfying pq = 2pi-2p +i 1 ~ ^l'^- 
In addition to A, W prepares three single-qubit registers B, Ri, and R2. All the qubits in A, B, Ri, and R2 are 
initialized to the |0) state. 

First, W performs the DISTILLATION PROCEDURE twice in sequence, once with (Ri, A, M) as input, and an- 
other with (R2, A, M) as input. If any of these two runs of the DISTILLATION PROCEDURE outputs a symbol _L, 
the simulation fails, and thus accept with giving up. If not failed, then W chooses two indices ri and r2 from 
the set {!,... , A^} uniformly at random. If r2 = 1, W accepts with giving up. Otherwise W swaps the regis- 
ters (Si,S'^) and (Sri,S^J if ri > 2, and further swaps ($2,52) and (S^ajS'^.^) if r2 > 3. Afterwards, W never 
touches the registers {Sj , S'j) for j > 3, and thus this process essentially has the same effect as performing a random 
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Verifier's QMA Protocol for Achieving Perfect Completeness with N Prior-Shared EPR Pairs 

1. Store the particles of the shared N EPR pairs in (Si, . . . , Sn). Receive an (m(|x|) + A^)-qubit quantum 
witness in (M, S'^, . . . , S'^), where the first m(|x|) qubits of the witness are in M, and the (m(|x|) + j)-th 
qubit of the witness is in Sj , for j G {!,..., N}. 

Prepare |0) in each of the three single-qubit registers B, Ri and R2, and |0)®*'(l^l) in a f (|x|)-qubit register A, 
which corresponds to the private space of the original verifier. 

2. Execute the DISTILLATION PROCEDURE with (Ri, A, M) as input. Accept if this outputs _L, and continue 
otherwise. Execute the DISTILLATION PROCEDURE again, this time using (R2, A, M) as input. Accept if 
this outputs _L, and continue otherwise. 

3. Choose two integers ri and r2 from {1, . . . , N} uniformly at random. Accept if r2 = 1 (accept with giving 
up due to failure of simulation), and continue otherwise. Swap the registers (Si, S'l) and (S,.^, S'^J if ri > 2, 
and further swap the registers (S2, S2) and (S^j, S^^) if '"a > 3. 

4. Test if the state in {Sj, S'j) is in the space spanned by {I'l'"), |^^)}, for each j G {1, 2}. Reject if not so, 
and continue otherwise. 

That is, perform the following for each j G {1, 2}: Apply T to the state in {Sj, S'j). Reject if S^ contains 1, 
and apply to the state in {Sj, S'j) to continue. 

5. Perform the Swap-Test between (Si, S'^) and (S2, S2). Reject if it fails, and continue otherwise. 

That is, apply H to B, swap (Si, S'^^) and (S2, S2) if B contains 1, apply H toB again, and reject if B contains 
1, and continue otherwise. 

6. Perform the REFLECTION SIMULATION TEST with (Ri, R2, Si, S^ S2, S2) as input. Accept if this returns 
"accept", and reject otherwise. 



Figure 6: Verifier's QMA protocol for achieving perfect completeness with N pre-shared EPR pairs. 

permutation over the registers (Si, S'^), . . . , (Sat, S'^). W then checks if the state in (Sj, S^) is in the space spanned 
by {1$"), 1^^)}, for each j G {1, 2}, and further performs the Swap-Test between (Si, S'^) and (S2, %) (using the 
register B as the conti-ol). Finally, W performs the REFLECTION SIMULATION TEST with (Ri, R2, Si, S'^, S2, S2) 
as input. The protocol is summarized in Figure |6] Notice that this protocol is exactly implementable when the 

Hadamard and any classical reversible transformations can be performed exactly. 

2 

For the completeness, suppose that x is in ^yes- Let p = 2p^-2p +i " honest Merlin sets his shares of 
the N EPR pairs in single-qubit registers S'^, . . . , S'^, and applies Wq to each qubit in (S'^, . . . , S'^) to create the 
state \ J{Wq)) in (Sj, Sj), for j G {1, . . . , A^}, where q satisfies pq = 1/2 (such a q always exists when px > 1/2, 
which is ensured by the completeness condition of the original QMA system). He also prepares \wx) in M, and 
sends the (m(|x|) + A^)-qubit state in (M, S'j^, . . . , S'^) as a witness. Then, conditioned on the first application of 
the Distillation Procedure not outputting _L, the state \xp) = Wp\0) is generated in Ri, and lO)'^^(l^l) \wx) 
is left in (A, M), and thus, the state \xp) is generated also in R2 when the second application of the DISTILLATION 
Procedure does not output _L. Conditioned on the chosen r2 not being 1 in Step 3, the protocol continues and the 
state remains the same after this step. When continued. Step 4 clearly never rejects and does not change the state at 
all, as the state in (Sj, S^) is \ J(Wq)) = y/l - q\^^) + ^|^'+) for each j G {1, 2}. Furthermore, the Swap-Test 
never fails in Step 5 and it does not change the state at all (and thus, the protocol never results in rejection in 
this step). Therefore, the state in (Ri, R2, Si, S'^, S2, S2) is Ixp)*^^ ^ \ J(Wq))'^'^, when entering Step 6. Hence, 
from Proposition [T9l the REFLECTION SIMULATION TEST results in acceptance with certainty, when the protocol 
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reaches Step 6. As rejections can happen only in Steps 4, 5, and 6, this proves the perfect completeness. 

Now for the soundness, suppose that x is in A^o- Let TZj, Sj, and Sj denote the Hilbert spaces associated with 
the quantum registers Rj, Sj, and S^, for each j, respectively. 

As the soundness error of the original QMA system is exponentially small, whatever state the register M 
contains, the probabihty that the first application of the DISTILLATION PROCEDURE outputs _L is exponentially 
small. Moreover, conditioned on this not outputting _L, the state generated in Ri is exponentially close to |0) (in 
trace distance). Similarly, whatever state left in M after the first application of the DISTILLATION PROCEDURE, 
the probability that the second apphcation of the DISTILLATION PROCEDURE outputs _L is exponentially small, 
and the state generated in R2 is exponentially close to |0). Hence, the state in (Ri, R2, Si, S'^, . . . , Sat, S'^) when 
entering Step 2 must be exponentially close to (|0) (0|)'^^ p for some 2A^-qubit state p such that the reduced state 
tTs[(s,...^s'j^P is equal to the A^-qubit totally mixed state {I /2)®^ . 

As Step 3 essentially has the same effect as performing a random permutation over the regis- 
ters (Si,S']^), . . . , (SAr,S'jy) for the purpose of computing the reduced state in (Si, S']^, S2, S2), from Theorem [H 
the state in (Ri, R2, Si, S'^^, S2, Sg) after Step 3 has trace distance at most ^ to the state 

a = (|0)(0|r^(j]p,ef) 

i 

for some two-qubit states ^j, where J2jPj = !> if ^^ate in (Ri, R2, Si, S'^, . . . , Sat, S'jy) were (|0)(0|)®^ p 
when entering Step 3 and if r2 7^ 1 (here we are taking the randomness over the choices of ri and r2 into account). 
By letting r = YljPj^f^' ^^^^ particular implies that for the reduced state tr^/^^^r and the two-qubit totally 
mixed state (//2)®2, 

holds, since tr^/^...^^/^^ = {I /2)®^ . Taking it into account that the protocol enters Step 3 with probability 
exponentially close to 1 with the state in (Ri, R2, Si, S'^, . . . , Sat, S'jy) being exponentially close to (|0)(0|)®^ (8) p 
in trace distance, we conclude that the protocol enters Step 4 with probability exponentially close to 1 — with 

the state in (Ri, R2, Si, S'^^, S2, Sg) having trace distance at most ^ + e to a for some exponentially small e. 

Now from Proposition |22] which will be found below and proved in the end of this section, the proto- 
col results in rejection with probability at least min{|J-, ^ — 18(|^) } if the state in (Ri, R2, Si, S'^, S2, S2) 
were a when entering Step 4. Hence, the protocol results in rejection with probability at least 

min{|^ — £tJq — — £ — 18 (^) }, when entering Step 4. As the protocol enters Step 4 with probability 
exponentially close to 1 — by taking = 2^^^, the protocol results in rejection with probability at least 

1 \ r 1 1 1 9 1 1 
^-^'•™n2^^'l6-2^^-2^P 



2113; 1 2109 '16 2107 2M - 2110' 

Hence, this proves the inclusion QMA C QMA^^^*"^^^(l, 1 — grni)- Now for any constant s € (0, 1), one 
can achieve soundness s simply by repeating this proof system t times in parallel for some appropriate constant t, 
as the system is a special case of two-message quantum interactive proof systems, for which parallel repetition 
works perfectly MKWOOI . This completes the proof. □ 

Finally, we prove the following proposition. 

Proposition 22. When entering Step 4 of the protocol described in Figure |^ suppose that the state in 
(Ri, R2, Si, S'^, S2, S2) were of the form (|0)(0|)'^^ ® r where r = 'YlijPj^f'^ faf some two-qubit states and 
real numbers pj £ [0, 1] satisfying ^jPj = 1, such that the reduced state of t in (Si, S2) has trace distance at 

most 5 to the two-qubit totally mixed state {I / 2)®'^ for some 6 satisfying — 185 12 > 0. Then the protocol results 



in rejection with probability at least min{25, ^ — 18(5 12 }. 
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To prove Proposition |22j we first show two propositions that are special cases of Proposition l22l 

Proposition 23. Let W be the two-dimensional space spanned by \ ^^) and \ ^^). When entering Step 4 of the pro- 
tocol described in Figure^ suppose that the state in (Ri, R2, Si, S'^^, S2, S2) were of the form (|0)(0|)®^ (gi r where 
T = '^jPj{\'>pj){'4'j\)'^'^for some two-qubit states £ W and real numbers pj G [0, 1] satisfying 'YljVj = 1> 
such that the reduced state ofr in (Si, S2) has trace distance at most 6 to the two-qubit totally mixed state (1/2)®^ 
for some 6 < 2~^^. Then the protocol results in rejection with probability at least — (32(5)3. 

Proof. Let a = (|0)(0|)®^ r. From Lemma |2T1 there exists a state r' that is a mixture of two-fold prod- 
ucts \J{Waj))'^'^ of a Choi-Jamiolkowski state, for real numbers aj € [0, 1], such that, for a' = (|0)(0|)®^ (g) r', 
D{a,a') < (325)^. From Proposition l20l the REFLECTION SIMULATION TEST results in rejection with probabil- 
ity if the state in (Ri, R2, Si, S'^^, S2, S2) were a'. This implies that the REFLECTION Simulation Test results 
in rejection with probability at least ^ — (32(5)5 if the state in (Ri, R2, Si, S'^, S2, S2) were a. Note that a is never 
rejected in Step 4 and passes the Swap-Test in Step 5 with certainty, and the state is not changed at all in these two 
steps. Hence, if the state in (Ri, R2, Si, S'^, S2, S2) were a when entering Step 4, the protocol results in rejection 
with probability at least — (32(5)5, as claimed. □ 

Proposition 24. Let W be the two-dimensional space spanned by \ ^^) and \ ^^). When entering Step 4 of the pro- 
tocol described in Figure^ suppose that the state in (Ri, R2, Si, S'^, S2, Sg) were of the form (|0) (Ol)*^^ (g r where 
T = j pjS^j^^ for some two-qubit states G D(yV') and real numbers pj G [0, 1] satisfying YljPj — ^> ^^'^^ 
the reduced state ofr in (Si, S2) has trace distance at most 6 to the two-qubit totally mixed state (1/2)®^ /or some 
6 satisfying ^ — 13(56 > 0. Then the protocol results in rejection with probability at least min|2(5, jq — 13(56 }. 

Proof. Let a = (|0)(0|)®^ r. Note that a is never rejected in Step 4, and the state is not changed at all in this 
step. 

Fix a positive constant 7 G (0,1), and let S be the set of indices j defined by 

5 = {j:tre/>l-7}. 

Notice that the inequality tr^^^ > 1 — 7 implies that the maximum eigenvalue of the Hermitian matrix is at least 
1 — 7, and thus, for each j G S, there exist a two-qubit pure state Itpj) G W, a two-qubit state uj G D(W), and a 
real number Xj G [1 — 7, 1] such that = Xj\'ipj){ipj\ + (1 — Xj)vj. This implies that 

ll^i - IV'i)(V'jl||tr = ll^il^jXV'il + (1 - Aj>j - |V'j)(V'il||tr = (1 - AjOiki - IV'i)(^il||tr' 

which further implies that D{S,j, |V'j)(V'il) < (1 — < 1 — Aj < 7. Fix another positive con- 

stant fi G (0, 1). 

If "Yj^sPj < 1 — fi, the Swap-Test in Step 5 results in rejection with probability greater than ^fij. 
On the other hand, if X^jg^Pj > 1 — A*, the state a has trace distance at most 27 + to the 
state a' = (|0)(0|)®2 ,g, r', where 

and the reduced state of r' in (Si, S2) has trace distance at most (5 + 27 + /x to (1/2)®^. 
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and thus, 

D{a,a') = D{t,t') 



< 27 + ^. 



As the reduced state of r in (Si, S2) has trace distance at most 6 to (//2)®^, it follows that the reduced state of 
r' in (Si, S2) has trace distance at most 5 + 27 + /i to (//2)®^. Now from Proposition [23l the protocol results 
in rejection with probability at least ^ — [32(5 + 27 + /i)] 3 if the state in (Ri, R2, Si, S'^, S2, S2) were a' when 
entering Step 4. Hence, the protocol results in rejection with probability at least ^ — 27 — /i — [32((5 + 27 + fi)]^ 
if the state in (Ri, R2, Si, S'^^, S2, S2) were a when entering Step 4. 

Overall, taking 7 = = 2(52 , the protocol results in rejection with probability at least 



mm 



|25, ^ -65^ - [32(5 + 6<5^)] ^} > min|25, - 6(5^ - 76^ > min|2(5, ^ - 13(5^} 



16 L ' ) - I ' 16 J ~ I ' 16 

if the state in (Ri, R2, Si, S'^^, S2, S2) were a when entering Step 4. This completes the proof. 

Now we are ready to prove Proposition [ 



□ 



Proof of Proposition \22\ Let a = (|0)(0|)®^ r. Fix a constant 7 € (0, 1), and let W be the two-dimensional 
space spanned by \^^) and 1^'"'"), and let Uy\> = |$~)($~| + be the projection onto W. 

If trll^^T < 1 — 7, Step 4 results in rejection with probability greater than 7. 

On the other hand, if trll^^r > 1 — 7, we claim that the state a has trace distance at most y/j to the 
state a' = (|0)(0|)®2 ^ t', where 

^ = l^Pj^j 
j 
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with 



for each j, and the reduced state of t' in (Si, S2) has trace distance at most 7 to (1/2)® . Note that p'j G [0, 1] and 
^'j G D(>V) for each j, and P'j = 1- 

Let S be the 2'^-dimensional Hilbert space C(E^) associated with the quantum register (Si, S'^^, S2, S2) and 
let T be another 2^ -dimensional Hilbert space C(S^). Consider any purification \ip) G 5 (8) T of r G 0(5), and 
define an eight-qubit pure state \ip') G S 0Tby 

U'\ = ^ {U^ 



Then, |^') is a purification of r', since 



1 



^^^l^'^^^'l = --^trr(n^^ 0/r)IV')(V'l(n^^ ® /r) 

||(n^2^/r)|V>|| 



where the last equality follows from the fact that 



trn^V^ ^^^^^ "^trnw^, trn^V^"^^ ^^^^ trn^V 
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Therefore, by using the fact that D{\iIj){iIj\, ) = y^l — | (V'lV'') P holds for any pure states and |^') 
(which is ensured by calculating eigenvalues of the Hermitian matrix — |V'')(V''|)> 

D{a,a') = D{T,T') 



< Z)(|^)(^|, = = ^Jl-\\{U^C^ITmf = yJl-trU^r < ^. 

As the reduced state of r in (Si,S2) has trace distance at most 5 to (//2)®^, it follows that the re- 
duced state of t' in (Si,S2) has trace distance at most 5 + ^ to (1/2)®^. Now from Proposition |24l 

the protocol results in rejection with probability at least min{2((5 + 1/7), — 13((5 + y/^)'^^ if the state in 
(Ri, R2, Si, S'^, S2, S2) were a' when entering Step 4. Hence, the protocol results in rejection with probability 
at least min{2(5 + ^77) — .^7, ^ — ^77 — 13(5 + ^/7) ^ } if the state in (Ri, R2, Si, S'^^, S2, S2) were a when en- 
tering Step 4. 

Overall, taking 7 = 25, the protocol results in rejection with probability at least 



minj 25, 2(5 + (25)5,-1 -(25) I -13 [(5 + (25)^] 6 1 > min|25, ^ -25^ - 13(35^)i | > min|25, ^ - 185i^ | 
if the state in (Ri, R2, Si, S'^^, S2, S2) were a when entering Step 4. This completes the proof. □ 



7 Achieving Perfect Completeness in QIPs with One Additional Message 

Now we show that any m-message QIP system with two-sided bounded error can be converted into an (m + 1) 
message QIP system with one-sided error of perfect completeness, for any m>2. 
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Theorem 25. For any polynomially bounded function m : Z"*" — )• N and polynomial-time computable func- 
tions c, s : Z^" — )• [0,1] satisfying m >2 and c — s > 1 /pfor some polynomially bounded function p : Z+ — )• N, 



QIP(m,c,s) C Qip(^m + 1,1,1 
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If m is an odd-valued function whose values are at least three, we can show a stronger statement that any 
m-message QIP system with two-sided bounded error can be converted into another m-message QIP system with 
one-sided error of perfect completeness. 

Theorem 26. For any polynomially bounded odd-valued function m : Z+ — )■ 2N + 1 and polynomial-time com- 
putable functions c, s: Z"*" — )• [0, 1] satisfying m > 3 and c — s > 1/p for some polynomially bounded func- 
tion p : Z+ N, 



QIP(m,c,s) C QIP m, 1,1 - 




Remark. In fact, in Theorems |25] and |26l it is sufficient for the claims that the functions c and s satisfy c — s > 2 ^ 
for some polynomially bounded function p : Z+ — > N. 

With the perfect parallel repetition theorem for general quantum interactive proofs IIGut09ll . the following 
corollaries immediately follow. 

Corollary 27. For any polynomially bounded functions m,p: Z+ — )• N and polynomial-time computable func- 
tions c, s : Z+ — )■ [0, 1] satisfying m > 2 and c — s > 1/qfor some polynomially bounded function q : Z"*" — )■ N, 

QIP(m, c, s) C QIP(m + 1, 1, 2"^). 



Corollary 28. For any polynomially bounded odd-valued function m : Z+ — )• 2N + 1, polynomially bounded func- 
tion p : Z+ — )• N, and polynomial-time computable functions c, s : Z^ — t- [0,1] satisfying m > 3 and c — s > 1/q 
for some polynomially bounded function q : Z+ — )• N, 

QIP(m, c, s) C QIP(m, 1, 2~p). 



7.1 Modified Reflection Procedure 

The Reflection Procedure in Section |5] involves one application of U and one apphcation of U"^. Here we 
modify the procedure so that it involves one application of only (and no application of U is required). 

To do this, one expects to receive a state just after Step 1 of the REFLECTION PROCEDURE, and performs two 
tests, called REFLECTION TEST and INVERTIBILITY Test, respectively, with equal probability without reveahng 
which test the prover is undergoing. In the REFLECTION TEST, we simply perform Steps 2-4 of the REFLECTION 
Procedure to finish the simulation of it, whereas in the Invertibility Test, we apply U"^ without performing 
the phase-flip to check that the state received was a legal state that can appear just after Step 1 of the REFLECTION 
Procedure. The idea of making use of the Invertibility Test has originally appeared in Ref. IIKKMV09I 
when achieving perfect completeness in quantum multi-prover interactive proofs. From another viewpoint, the 
modification here may be considered as applying the "halving technique" in Ref. IIKKMV09II to the REFLECTION 
Procedure, the technique originally used to reduce the number of turns by (almost) half in quantum multi-prover 
interactive proofs. We will take this view when analyzing the soundness of this procedure in Proposition [30lbelow. 
The procedure is summarized in Figure |2l 
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Modified Reflection Procedure 

1. Receive a quantum register Q. Flip a fair coin, and proceed to the Reh^eCTION Test in Step 2 if it results 
in "Heads", and proceed to the Invertibility Test in Step 3 if it results in "Tails". 

2. (Reflection Test) 
Perform the following: 

2.1 Perform a phase-flip (i.e., multiply —1 in phase) if the state in Q belongs to the subspace corresponding 
to the projection Ho. 

2.2 Apply C/t to Q. 

2.3 Reject if the state in Q belongs to the subspace corresponding to the projection Aq, and accept other- 
wise. 

3. (Invertibility Test) 
Perform the following: 

3.1 Apply to Q. 

3.2 Accept if the state in Q belongs to the subspace corresponding to Aq, and reject otherwise. 



Figure 7: The MODIFIED REFLECTION PROCEDURE. 

Proposition 29. If the Hermitian operator M = /S.^U'^HqU Aq has an eigenvalue 1 /2, there exists a quantum state 
given in Step 1 of the MODIFIED REFLECTION PROCEDURE such that the procedure results in acceptance with 
certainty. 

Proof. The proof is almost straightforward. Let be an eigenvector of M corresponding to its eigenvalue 1/2, 
and consider the case where the state U\iIj*) is received in Q in Step 1. 

If the Reflection Test is performed, this essentially simulates the original Reflection Procedure with 
its received state being |^*). As in the case of Proposition [TTl the procedure results in acceptance with certainty in 
this case. 

On the other hand, if the Invertibility Test is performed, this produces the state C/tC/|^*) = |^*) 
when entering Step 3.2. As is an eigenvector of M with its corresponding eigenvalue 1/2, it holds that 
AolV'*) = 2AoM|'(/'*) = 2M\'4>*) = \'4>*), and thus. Step 3.2 results in acceptance with certainty. 

Hence, given the state U\'4)*) in Step 1, the procedure results in acceptance with certainty, and the claim 
follows. □ 

Proposition 30. For e > 0, suppose that none of the eigenvalues of the Hermitian operator M = /S.^U'^HqU /S.q 
is in the interval — e, ^ + e). Then, for any quantum state given in Step 1 of the MODIFIED REFLECTION 
Procedure, the procedure results in rejection with probability at least e^. 

Proof. The proof is similar to the proofs of Lemmas 4.1 and 5.1 in Ref. IIKKMV091 . Let jV') be any state received 
in Q in Step 1. Denote the unitary transformation U'^ {—Hq + IIi) by V, and let 

Ai^lV^) Aot/t|V> 



a) 



lAi^iv^)!!' l|Aof/t 



Then 
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and thus, the probabiUty pi of acceptance when the REFLECTION TEST is performed is given by 

pi = F{V^\a){a\V,\i;){i;\)\ 
Similarly, the probability p2 of acceptance when the INVERTIBILITY TEST is performed is given by 

P2 = F{U\f3){f3\U\\i^){i^\Y- 
Hence, the probability pacc of acceptance when the received state in Step 1 was |^) is given by 

Pace = liPl +P2) = ^[F{V^a){a\V, IV'XV'I)' + F{U\(3){(3\U\ |V^)(V^|)' 
It follows from Lemma|7]that 

Pace < + F{V^\a){a\V,U\l3){p\U^)^ = ^{l + F{\a){a\,VU 

Now notice that |/3) is a state in Xq, and thus, 

\\AiVU\^)f < 1 -4e^ 

since || Aoy?7|/3) |p > from the analysis on the REFLECTION PROCEDURE in the proof of Proposition [181 
Hence, using Ai|q) = |q), 

F{\a){a\,VU\P){l3\U^V^) = \{a\VU\f3)\ = | (a| Aiy[7|/3)| < || Aiy[7|/3)|| < Vl-4e2, 

and thus, 

1 Vl - 4e2 1 l-2e2 
P^c<- + ^^<- + ^ = l-e\ 

Therefore, the procedure results in rejection with probability at least e'^, as claimed. □ 
7.2 Perfectly Rewindable QIPs 

Here we introduce the notion of perfectly rewindable QIP systems. The concept of perfectly rewindable systems 
was originally introduced for quantum multi-prover interactive proofs in Ref. [.KKMVOQJ . and the notion here is 
the single-prover version of it as a special case. 

Definition 31. Given a polynomially bounded function m : Z+ — )• N and a function s : Z+ — )• [0, 1] satisfying 
s < ^, a promise problem A = {^yes, ^no} has a perfectly rewindable m-message quantum interactive proof sys- 
tem with soundness s iff there exists an m-message polynomial-time quantum verifier V such that, for every 
input x: 

(Perfect Rewindability) if x £ Ayes, there exists an m-message quantum prover P such that the maximum prob- 
ability that V accepts x when communicating with P is exactly 1/2, where the maximum is taken over all 
possible initial states of P, 

(Soundness) if x € A^o, for any m-message quantum prover P' and any initial state p'^ of P' prepared, V accepts 
X with probabihty at most s(|x|). 

Note that in the perfect rewindability property we first fix the transformations of the prover, and then maximize 
over all legal initial states, which hence have a fixed dimension. We first show how to modify any general QIP 
system to a perfectly rewindable one without changing the number of messages. 
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Lemma 32. Let m: Z"*" 'N be a polynomially bounded function and let c, s: Z+ — t- [0, 1] be polynomial-time 
computable functions satisfying c — s > 1/p for some polynomially bounded function p: Z+ — )■ N. Then, any 
promise problem A = (^yes,^no) in QIP(m,c, s) has a perfectly rewindable m-message quantum interactive 
proof system with soundness ^ — 

Proof. Let A = (^yes,^no) be a problem in QIP(m, c, s) and let V be the corresponding m-message quan- 
tum verifier. We first modify V to obtain another m-message quantum verifier V that witnesses the inclu- 
sion A G QIP(m, ^ + ^ + . This can be done via a standard technique as follows. Fix an input x. The 
new verifier V' behaves in a manner exactly same as V, except for the acceptance condition. If c{\x\) + s{\x\) > 1, 
V' accepts with probability when the final state in the system would make V accept (and reject oth- 

erwise). Thus, V accepts x £ Ay^^ with probabihty at least ed^i^l+Pd^ l ) = + c(H)+^(Hj )' "^^^^^ accepts 
X £ Ano with probability at most = ^(l - Similarly, if c(|x|) + s{\x\) < 1, lettmg 

= 1 - c(|x|) and 5{\x\) = 1 - s{\x\), V rejects with probability ^(|^.|)^^(|^|) = when the fi- 

nal state in the system would make V reject (and accept otherwise). Thus, V' rejects x G Ayes with probability 
at most ,(|J;H}|, | ) = i(l - fS^S) = W- 2^lt\)-lt \ ) )' ^hile V rejects x G A^, with probability at 
least = Ml + T \ )TS) ) = Ml + Taking it into account that, with a given finite- 

size gate set available for the verifier, it may not be possible to accept with probability exactly 
casec(|x|) + s(|x|) > 1 or with probability exactly ^^l^iyi^piy = 2-ci \ x \ )-si \ x \ ) i" the case c{\x\) + s(|x|) < 1, we 
actually consider another verifier V" who approximately performs the transformations of V' with sufficient accu- 
racy, where the transformations of V" are exactly implementable with the given finite-size gate set available for the 
verifier. As both c(|x|) + s(|x|) and 2 — c(|2;|) — s(|x|) are at most 2 — 1, the bounds obtained above are sufficient 
to claim that the m-message system with the verifier V" has completeness ^ + and soundness ^ — 

The rest of the proof is essentially the same as the proof of Lemma 3.2 in Ref. IIKKMV09I . We further modify 
V" to construct another m-message quantum verifier W for a perfectly rewindable proof system for A. The new 
verifier W prepares a single-qubit register B in addition to the register V which corresponds to the space used by 
V" . The qubit in B is initialized to |0). behaves exactly in the same manner as V" does, except that, in addition 
to all actions V" would do, W also sends B to the prover in the last message from the verifier and receives B from 
the prover in the last message from the prover. As for the final decision, W accepts if and only if the content of V 
would make V" accept and B contains 1. Notice that W accepts only if V" would accept, and thus, the soundness 
is obviously at most 1 + 

For perfect rewindability we slightly modify the protocol of the honest prover in the case x G Ayes- Given 
a protocol of the honest prover P in the system with V" and an initial state IV'init) in the system with V" that 
achieves the maximal acceptance probability Pmax when V" communicating with this P, we construct a protocol 
of the honest prover Q in the system with W as follows. Q uses iV'init) as the initial state and behaves exactly in 
the same manner as P does, except that, upon receiving the last message from W, Q applies to the qubit in B the 
one-qubit unitary transformation U satisfying 

^Ho)^yi-^io)+y^ii)' 

V -^/^max V ■''i^max 

in addition to all what the original P would do. From the construction it is obvious that the maximum accepting 
probability of W when communicating with Q is exactly equal to ^ and that this maximum is achieved when Q 
uses I'f/'init) as the initial state. Finally, as the transformations of V" are exactly implementable with the given 
finite-size gate set available for the verifier, so are the transformations of W. □ 

Remark. In fact, in Lemma [32] it is sufficient for the claim that the functions c and s satisfy c — s > 2^^ for some 
polynomially bounded function p : Z+ — >• N. 
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7.3 Proofs of Theorems |2l] and |26] 



Now we are ready to show Theorems [25] and |26] First we prove Theorem |26l assuming that m is an odd-valued 
function and m> 3. The case of general m is proved in the same manner as this special case, except that the 
number of messages increases by one when m(|x|) is even, which gives Theorem [25] 

Proof of Theorem\26\ As m is an odd-valued function and m > 3, there is a polynomially bounded func- 
tion r : Z+ N such that m = 2r + 1. Let A = (ylyes, Ano) be in QIP(2r + 1, c, s). Then from Lemma [32] 
A has a perfectly rewindable (2r + 1) -message quantum interactive proof system with soundness ^ — Let 
V be the verifier of this perfectly rewindable (2r + l)-message quantum interactive proof system. We construct 
another (2r + l)-message quantum verifier W of a new quantum interactive proof system for A. 

Fix an input x. Let V be the quantum register consisting of private qubits used by the original verifier V, 
and let M be the quantum register consisting of qubits used for communications in the original proof system. Let 
Vxj be the jth transformation of V, for each j G {1, . . . , r{\x\) + 1}, acting over (V, M). The new verifier W 
uses the same registers V and M as the original verifier V. W first receives the two registers V and M, expecting 
that the state in (V, M) forms what V would have after the last message from a prover had been received in the 
original proof system. W then performs one of the two tests, called "REFLECTION Test" and "INVERTIBILITY 
Test", chosen uniformly at random. In the "REFLECTION Test", W first performs a phase-flip if the state in 
(V, M) would cause V to accept when the last transformation T4,r{|x|)+i of ^ was performed, and then moves 
to a backward simulation of the original system. W accepts when the backward simulation does not produce a 
legal initial state of the original system. In the "INVERTIBILITY Test", just immediately moves to a backward 
simulation of the original system. This time, W accepts when the backward simulation does produce a legal initial 
state of the original system. The exact protocol is described in Figure [8] Notice that the number of messages in this 
system is indeed 1 + 1 + 2(r(|x|) — 1) + 1 = 2r(|x|) + 1 = m(|x|). 

For the completeness, suppose that x is in j4yes. 

As the original system was perfectly rewindable, there exists a (2r + 1) -message quantum prover P in the 
original system such that the maximum probability that V accepts x when communicating with this P is exactly 
1/2, where the maximum is taken over all possible initial states of P. Let P be the quantum register consisting of 
the private qubits of this P, and let P^j be the jth transformation of P, for each j G {1, . . . , r{\x\) + 1}, acting 
over (M, P). Let |^/;*) be an optimal initial state in (M, P) with which P achieves the accepting probability 1/2 
(note that P possesses the message register M at the beginning of the protocol, and that there always exists an 
optimal initial state that is pure). 

Denote the Hilbert spaces associated with V, M, and P by V, 7W, and V, respectively. Since the first action is 
done by P in this original proof system, one can assume without loss of generality that Px^i = Im^v (i-^-' the first 
transformation of P may be regarded as a part of preparing the initial state). Taking this into account, define the 
unitary transformation Qx acting over (V, M, P) by 



where Ilinit is the projection onto the subspace spanned by states in which all the qubits in V are in state |0), and 
Ilacc is that onto the subspace spanned by accepting states of the original system. Then the quantum state \4>*x) 
in (V, M, P) defined as = |0)v ® |V'^)(m,p) is the eigenvector of with its corresponding eigenvalue 1/2, 
since 



Qx = {yx,r(\x\)+l ® Ir) {iv ® -Pr!;,r(|x|)+l) " " 



(14,2 ® Iv) {IV «> Px,2) {Vx,l «) Iv) 



and further define the Hermitian matrix by 



Mx = ninitQTn, 



acc 



imxi^) 




max ||naccQx(|0)v ® = ||naccQx(|0)v ® = {4>*x\Mx\4>*x) 



1 



max 



2 
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Verifier's Protocol for Achieving Perfect Completeness (Odd-Number-Message Case) 

1 . Receive quantum registers V and M . 

2. Choose b G {0, 1} uniformly at random. If 6 = 0, move to the REFLECTION TEST described in Step|3l while 
if 6 = 1, move to the INVERTIBILITY TEST described in SteplH 

3. (Reflection Test) 

3.1 Apply Vx^r{\x\)+i to the state in (V, M). Perform a phase-flip (i.e., multiply —1 in phase) if the content 
of (V, M) corresponds to an accepting state of the original system. Apply to the state in 
(V, M), and send M to the prover. 

3.2 For J = r{\x\) down to 2, do the following: 

Receive M from the prover. Apply j to the state in (V, M), and send M to the prover. 

3.3 Receive M from the prover. Apply to the state in (V, M). Reject if all the qubits in V are in state |0), 
and accept otherwise. 

4. (INVERTIBILITY TEST) 

4. 1 Send M to the prover. 

4.2 For j = r{\x\) down to 2, do the following: 

Receive M from the prover. Apply j to the state in (V, M), and send M to the prover. 

4.3 Receive M from the prover. Apply V,j to the state in (V, M). Accept if all the qubits in V are in 
state |0), and reject otherwise. 



Figure 8: Verifier's protocol for achieving perfect completeness with m = 2r + 1 

Now, with a (2r + l)-message quantum prover R in the constructed system who prepares the 
state IC^) = -^■p)Qx|0x) in (V, M,P) as an initial state and applies Rx,i = Im®v 

and Rx^j = Px,r{\x\)-j+-i for each j G {2, . . . , r(|x|) + 1}, the constructed protocol may be 
viewed as performing the MODIHED REFLECTION PROCEDURE with its underlying quantum 
register Q = (V, M,P), unitary transformation U = iyl ^(]^x\)+i® -^'P)^^' ^'^'^ projection opera- 
tors Aq = limit and Ho = (S" /-p)nacc(^a:,r(|a;|)+i -^p)- ^s the associated Hermitian opera- 
tor M = Ao?7^noC/Ao = ninitQinaccQxHinit = Mx has an eigenvalue 1/2 with its corresponding eigenvec- 
tor 10*) = |0)v ® |V'^)(M,P)' from Proposition [29j the protocol results in acceptance with certainty with this 
prover R and the initial state |^*.) = {ylr{\x\)+i ® ^v)Qx\4>*x) = U\4>%), which shows the perfect completeness. 

Now for the soundness, suppose that x is in Ano- 

Let R be any (2r + l)-message quantum prover of the constructed system, and let R be the quantum register 
consisting of the private qubits of R. Suppose that R applies the unitary transformation Rx^j to the state in (M, R) 
as the jth transformation of R, for each jG{l,...,r(|x|) + l}. 

Define the unitary transformation Qx acting over (V, M, R) by 

Qx = {yx,r{\x\)+i ® In) {Iv ^ 4,2) • • • (^^,2 In) {Iv «> {yx,i ^ In) , 

where TZ is the Hilbert space associated with the register R. Then the constructed protocol may 
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be viewed as performing the MODIFIED REFLECTION PROCEDURE with its underlying quantum regis- 

'^x,r{\x\)+l ' 



ter Q = (V, M, R), unitary transformation U = r(\x\)+i ^ ^Tl)Qx, and projection operators Aq = Hinit and 



-'^0 ~ (Kc r(|z|)+i ® ^'R)^s.cc{yx,r{\x\)+i ® Itz) ■ The associated Hermitian operator of this MODIFIED REFLEC- 
TION Procedure is given by 

iV4 = AqU^UqUAo = HinitQinaccQxHinit. 

Consider the following (2r + 1) -message quantum prover P' in the original system: P' uses R as a register con- 
sisting of his/her private qubits, and applies Im^h as his/her first transformation, and i?^ r(|x|)-j+3 his/her jth 
transformation, for j G {2, . . . , r(|2;|) + 1}. Then, from the soundness property of the original system, no matter 
which state P' initially prepares, the accepting probability is at most ^ — £ll£iiz£il£il^ which implies that all the 
eigenvalues of Mx is at most ^ — ^d^D'^d'^l^ Hence, from Proposition [30l the constructed protocol results in 
rejection with probability at least ^'^d^D'^^I^D^ ^ which ensures the soundness 1 — ^'^"^6^ ■ 

Finally, the protocol given in Figure [8] slightly deviates from the standard form of quantum interactive proof 
systems in that the length of the first message from a prover is different from the lengths of other messages, 
which may be easily modified into a standard-form system that has exactly the same number of messages and 
completeness and soundness parameters. □ 

Now we prove Theorem l25l The proof is essentially the same as the proof of Theorem |26l and we analyze the 
case where the number of messages is even. 

Proof of Theorem \25\ Let A = (Ayes, ^no) be in QIP(m, c, s). Then from Lemma [32] A has a perfectly rewind- 
able m-message quantum interactive proof system with soundness ^ — Let V be the verifier of this perfectly 
rewindable m-message quantum interactive proof system. We construct an (m + 1) -message quantum verifier W 
of a new quantum interactive proof system for A. The construction is essentially the same as that in the proof of 
Theorem |26l 

Fix an input x. Suppose that m(|3;|) > 2 is even, and write m(|x|) = 2r(|x|) for some r(|x|) € N. (the proof 
of Theorem |26] already shows the case where m(|x|) is odd). The exact protocol is described in Figure |9l where 
the only difference from the protocol in Figure [8]lies in the condition of judging whether the state is initialized or 
not - now a state is a legal initial state only when all the qubits in both of V and M must be in state 1 0) . Notice that 
the number of messages in this system is indeed 1 + 1 + 2(r(|2;|) — 1) + 1 = 2r(|3;|) + 1 = m(|x|) + 1. 

The analysis on this protocol is essentially the same as that in the proof of Theorem |26l and is omitted. □ 

7.4 Cases with Quantum Multi-Prover Interactive Proofs 

With essentially the same arguments discussed in this section, we can show similar properties even for quantum 
multi-prover interactive proof systems. The model of quantum interactive proofs we use is that in the most general 
setting (i.e., both of a verifier and provers use quantum computation and communications, and provers can share 
arbitrary entanglement of arbitrarily large size). Let QMIP(/i;, m, c, s) be the class of problems having m-turn 
quantum /c -prover interactive proof systems with completeness c and soundness s. See Ref. I KKMV09 I for rigorous 
definitions of the quantum multi-prover model and resulting complexity classes. Here we give only the statements 
of theorems, as proofs of those theorems are essentially same as Theorems |25] and [26] Note that these theorems 
give a more communication-efficient way of achieving perfect completeness in quantum multi-prover interactive 
proofs than the original method presented in Ref. [|KKMV09,I . where the number of turns increases by a factor of 
three. 

Theorem 33. For any polynomially bounded functions k,m: — t- N and polynomial-time computable func- 
tions c, s : —7- [0, 1] satisfying m > 2 and c — s > 1 /pfor some polynomially bounded function p : Z^ — t- N, 

QMIP(A:, m, c, s) C QMIP A:, m + 1, 1, 1 - ■ 

\ 16 
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Verifier's Protocol for Achieving Perfect Completeness (Even-Number-Message Case) 

1 . Receive quantum registers V and M . 

2. Choose b G {0, 1} uniformly at random. If 6 = 0, move to the REFLECTION TEST described in Step|3l while 
if 6 = 1, move to the INVERTIBILITY TEST described in SteplH 

3. (Reflection Test) 

3.1 Apply Vx^r{\x\)+i to the state in (V, M). Perform a phase-flip (i.e., multiply —1 in phase) if the content 
of (V, M) corresponds to an accepting state of the original system. Apply to the state in 
(V, M), and send M to the prover. 

3.2 For J = r{\x\) down to 2, do the following: 

Receive M from the prover. Apply j to the state in (V, M), and send M to the prover. 

3.3 Receive M from the prover. Apply to the state in (V, M). Reject if all the qubits in (V, M) are in 
state 1 0) , and accept otherwise. 

4. (INVERTIBILITY TEST) 

4. 1 Send M to the prover. 

4.2 For j = r{\x\) down to 2, do the following: 

Receive M from the prover. Apply j to the state in (V, M), and send M to the prover. 

4.3 Receive M from the prover. Apply -^^ to the state in (V, M). Accept if all the qubits in (V, M) are in 
state |0), and reject otherwise. 



Figure 9: Verifier's protocol for achieving perfect completeness with m(|x|) = 2r(|x|) 



Theorem 34. For any polynomially bounded function k : — t- N, polynomially bounded odd-valued func- 
tion m : Z+ —7- 2N + 1, and polynomial-time computable functions c, s : Z+ — t- [0, 1] satisfying m >3 and 
c — s > 1 /pfor some polynomially bounded function p : — t- N, 

QMIP(A;, m, c, s) C QMIP (^/c, m, 1, 1 - ^'^ ) • 

Remark. Similar to the single-prover case, in fact, it is sufficient for the claims in Theorems [33] and [34] that the 
functions c and s satisfy c — s > 2"^ for some polynomially bounded function p : Z"*" — )■ N. 
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